Execution lineage.
Every execution request binds to a tenant. The policy decision, the Ed25519 authorization artifact, the audit chain entry, and the decision hash are all scoped to that tenant, chained, persisted, and independently verifiable.
# Append-only, tamper-evident lineage [n-2] sha3_512: d41a…9c0 verified [n-1] sha3_512: 7e22…ab5 verified [n ] sha3_512: f4c1…7e2 verified blake2b : a90d…11b artifact: ed25519:9b3a…c41 decision: ALLOW prev : 7e22…ab5 chained
Multi-tenant isolation, enforced per request
No tenant sees another tenant's lineage.
No tenant can replay another tenant's authorization. Isolation is enforced at the moment of decision, not reconstructed after the fact.
- ✓ Tenant-scoped policy evaluation
- ✓ Tenant-scoped authorization artifact
- ✓ Tenant-scoped audit chain
- ✓ Tenant-scoped decision hash
- ✓ Every entry bound to a tenant
What lineage guarantees
Logs are not evidence. Lineage is.
APPEND-ONLY
Append-only chain
Each entry references the prior hash. Tampering breaks the chain and is detectable.
VERIFIABLE
Independently reproducible
Decision hashes and lineage are published to a public proof endpoint.
SCOPED
Per-tenant boundary
Every artifact records a tenant_id at issuance.
Inspect the lineage yourself.
Decision hashes and lineage are published machine-readable. Verify any decision against the live control plane.