LiveWhat evidence does a presence check leave behind?
Signed records
Every decision — including the ones that were allowed — is sealed with an Ed25519 signature over its canonical form, chained to the record before it.
Sealed at decision time
The signature covers the canonical JSON of the sealed payload together with its chain hash, so neither the record nor its position in history can be altered without detection.
Every decide response carries a verification bundle: the sealed payload, both chain hashes, the signature, and the URLs of the published key and the verifier. The caller already holds the evidence — nothing has to be requested back from us.
Rollout-stage changes and agent enrollments seal their own governance records, so configuration history is evidence too.
Check it yourself
The artifacts behind this page
- Verify a record offline with the published key.Verify a record →
- The signing keys, published as JWKS and PEM.Signing keys →
What this page does not claim
Limits
- A record proves it has not been altered and that we signed it. It does not by itself prove its position in the chain — that would need the neighbouring records, which are tenant-scoped evidence.