The record, as issuedVerifies
Seal intact
The same bytes, the same seal. The shipped verifier passes.
Evidence that does not need us.
A record you can only check by asking the vendor is testimony, not evidence. Every governed action here is sealed in a signed, tamper-evident record, and the record can be verified offline, without access to our systems.
- proposed
- the action, as the agent stated it
- checked
- the rules it faced, by name
- verdict
- ALLOW · HOLD · REFUSE
- when
- the moment of the verdict, timestamped
- signed
- sealed, so alteration shows
Illustrative. Field names, not rule contents.
Three desks
Who the record is for. Each asks a different question of the same record.
Your own audit function
Internal audit wants to test what a system did, and usually has to settle for what the policy said it would do. A sealed record per governed action closes that distance.
The question becomes “show me the records” — and the same input gives the same verdict, every time, so a sample re-run means something.
A counterparty
Delegated authority, outsourcing, an agreement with warranties attached: someone on the other side wants to know what your systems did under it.
The evidence a period produces can be handed to a third party and verified with Admissible absent.
They do not have to take your word, and they do not have to take ours.
A regulator-facing team
Supervisory questions arrive after the fact and want specifics: what happened, when, under whose authority, and what was stopped.
The record is designed to support those answers with the actions themselves rather than a reconstruction.
Independence
Verification, with us absent. Ask any evidence vendor what happens to your records if they disappear.
One record, put through the shipped verifier three times: as it was issued, with one byte changed, and in a counterparty’s hands with no access to our systems at all.
One byte changedFails
Seal mismatch
Change the record and the seal stops matching. A quiet edit is not quiet.
In a counterparty’s handsVerifies
Offline
Handed over and checked with us absent. They do not take your word, or ours.
Illustrative. Three runs in the shape the verifier reports them. Not live output.
Sealed
Every governed action is sealed in a signed, tamper-evident record
A record that can be quietly edited after the fact is a draft, whoever signed it first.
Offline
Records can be verified offline, without access to our systems.
If checking your records needs our servers, our goodwill or our continued existence, they were never yours.
Handed over
The evidence a period produces can be handed to a third party and verified with Admissible absent.
Where standards and supervisors enter, the record is an input, not a conclusion.
Anatomy
What a record carries. The proposal, the checks, the verdict, the moment, the seal.
Recorded whichever way it goes
Allow is a verdict; so is refuse. A refused action is recorded with the reason it was refused — the failing checks, by name, not a bare no.
The refusals are half the story
An evidence system that only remembers successes is an archive of good news. The second question an auditor asks is about the action that did not happen: what was stopped, and why, and whether the stopping held.
Start here
Ask for the record first
Bring the workflow whose records you would have to produce. We will show you the verdict it gets, and hand you the record to check without us in the room.