Audit and evidence export

Draft for the planned pilot release. These pages describe the intended customer experience. Administration and hosted-service features are not yet released; no live product URL or support service is claimed.

The existing prototype records tool requests, policy decisions, approval events and tool results in a hash-chained ledger. Its packaged demonstration passes internal verification against the supplied key and local witness.

The released product must let authorised users find a session, understand the decisions and export an evidence bundle with its verification instructions and required public metadata.

Verification establishes only the checks actually performed. A local witness and a bundled public key do not prove an independently trusted historic timestamp or protect against wholesale replacement of the entire package.

The export screen and report must state:

• Which organisation, workflow and time range are covered.
• The applicable policy and product versions.
• Which integrity and signature checks passed or failed.
• The trust source for any external checkpoint or timestamp.
• Whether sensitive fields were removed, masked or disclosed.
• Any gap, missing event or unresolved execution state.

Exports require permission and are audited. Avoid including unrelated personal data or credentials. Preserve the unmodified original bundle and the verifier version when sharing with an authorised reviewer.