Execution lineage.
Every execution request binds to a tenant. The policy decision, the Ed25519 authorization artifact, the audit chain entry, and the decision hash are all scoped to that tenant, chained, persisted, and independently verifiable.
# Immutable, append-only lineage [n-2] sha3_512: d41a…9c0 verified [n-1] sha3_512: 7e22…ab5 verified [n ] sha3_512: f4c1…7e2 verified blake2b : a90d…11b artifact: ed25519:9b3a…c41 decision: ALLOW prev : 7e22…ab5 chained
Multi-tenant isolation, enforced per request
No tenant sees another tenant's lineage.
No tenant can replay another tenant's authorization. Isolation is enforced at the moment of decision, not reconstructed after the fact.
- ✓ Tenant-scoped policy evaluation
- ✓ Tenant-scoped authorization artifact
- ✓ Tenant-scoped audit chain
- ✓ Tenant-scoped decision hash
- ✓ No cross-tenant leakage
What lineage guarantees
Logs are not evidence. Lineage is.
Append-only chain
Each entry references the prior hash. Tampering breaks the chain and is detectable.
Independently reproducible
Decision hashes and lineage are published to a public proof endpoint.
Per-tenant boundary
Every artifact is bound to a tenant_id at issuance, isolation by construction.
Inspect the lineage yourself.
Decision hashes and lineage are published machine-readable. Verify any decision against the live control plane.