03 / Audit
Every material action becomes a reproducible decision record.
Preserve the chain from identity assertion to policy decision, approval, execution and outcome so audit evidence is created as part of the operation—not reconstructed later.
Evidence pipeline
Source. Normalize. Decide. Approve. Execute. Prove.
SourceIdentity, request and runtime telemetry.
NormalizeTyped event, authoritative source and trusted time.
DecidePolicy, reasons, obligations and current status.
ApproveAuthority, conditions and rationale.
ExecuteTool call, state change and outcome.
ProveEvidence bundle, trust graph and audit export.
Integrity pattern
Evidence with chain-of-custody context.
Use canonical event IDs, trusted time, detached signatures, content hashes, immutable logical sequence, controlled retention and export metadata appropriate to the customer boundary.
| Object | Core record |
|---|---|
| System | Owner, purpose, architecture, jurisdiction and risk tier. |
| Passport | CPID, identity, policy, context, status and signature. |
| Evidence | Source, version, confidentiality, integrity and reviewer. |
| Decision | Result, reason, obligations, authority and validity. |
| Event | Change, incident, drift, vulnerability and re-review trigger. |