AUDIT PACK - 019f9479 - SEALED 2026-07-24T15:00:57Z
Exported with 101 acknowledged gaps

This pack was exported before the compliance program was complete. A workspace administrator reviewed the gaps below and chose to export anyway. This acknowledgement is itself recorded in the sealed chain (completeness override), so the record shows the export was incomplete by acknowledgement, not complete.

Acknowledged by 1251f364-e38d-4360-b8be-7fea95f25206 on 2026-07-24T15:00:57Z (UTC).

  • requirement A.5.1 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.10 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.11 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.12 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.13 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.14 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.15 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.16 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.17 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.18 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.19 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.2 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.20 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.21 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.22 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.23 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.24 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.25 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.26 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.27 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.28 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.29 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.3 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.30 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.31 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.32 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.33 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.34 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.35 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.36 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.37 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.4 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.5 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.6 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.7 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.8 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.5.9 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.1 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.2 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.3 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.4 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.5 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.6 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.7 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.6.8 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.1 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.10 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.11 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.12 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.13 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.14 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.2 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.3 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.4 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.5 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.6 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.7 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.8 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.7.9 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.1 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.10 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.11 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.12 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.13 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.14 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.15 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.16 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.17 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.18 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.19 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.2 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.20 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.21 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.22 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.23 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.24 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.25 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.26 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.27 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.28 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.29 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.3 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.30 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.31 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.32 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.33 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.34 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.4 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.5 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.6 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.7 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.8 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • requirement A.8.9 has no applicability decision - decide it applicable and cover it with an implemented control, or exclude it with a justification
  • risk "A ransomware actor exploits an unpatched edge appliance to gain a foothold and encrypt the..." (019f947a-2081-7580-8a14-e8d54d9f409e) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Backups of the production database are stored unencrypted and restores are never exercised..." (019f947a-2142-79ad-aef9-58742f7d1237) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Branch-office traffic to the payment API traverses a legacy IPsec tunnel negotiated with d..." (019f947a-1dd0-7072-825a-4a4c021719d3) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Closed-account customer PII remains in the production database and the document archive we..." (019f947a-1f55-7a45-90f1-795b5111cae2) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Codeforge contractors retain repository and staging access after their engagement ends; no..." (019f947a-1ec3-73b1-9531-7cab801caa27) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Employees connect unsanctioned AI agents and assistants to production data stores and inte..." (019f947a-1c9a-7e1c-8b19-7575c1e4ecdb) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "Teams adopt unsanctioned SaaS tools that end up holding customer contact data, bypassing v..." (019f947a-1feb-7a8e-a8f7-0b70bc651222) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
  • risk "The same engineer who authors a payment-release change can approve and deploy it to produc..." (019f947a-1d2b-7ebf-87a1-6b1c1bc0bce6) is set to mitigate but has no treating control and no recorded acceptance. Add a control that treats it, or record an acceptance.
Issued via Kanonik - system of recordSealed 2026-07-24T15:00:57Z

Audit Evidence Pack

Information security evidenceiso27001:2022 - period 2026-07-24 to 2026-07-24

Workspace
019f9479-b47f-7653-8d5a-aa1a7aba96de
Framework
iso27001:2022
Period of coverage
2026-07-24 to 2026-07-24
Generated (UTC)
2026-07-24T15:00:57Z
Records sealed
145
Events in chain
145
Seal of recordsealed
chain head  4a199bf47065...3e5df0e7
signature  ECDSA P-384 (FIPS)
signing key  chain-root:v1@vault
signed at  2026-07-24T15:00:57Z
chain length  145
head signature  30650231009b...bd002c0d
This page is a readable view of the same records held in the signed bundle. The seal proves the records were not changed after capture. See Integrity below to verify it yourself.
1

Overview

This pack is the complete set of records captured for this workspace during the period. Each record was checked before it took effect and approved by a named person, and the whole set is sealed so it cannot be altered after the fact.

0
Policies
0
Procedures
0
Controls
145
Sealed records
2

Risk, scope, and treatment

The risk-driven spine an ISO 27001 audit is built on: what is in scope, the risks assessed against it, how each is treated, and what remains open. Derived from the same sealed records as the rest of this pack.

Compliance packages

PackageScope
AI governance fast-startWhere AI agents and assistants touch Acme systems and data: sanctioned access, prompt-data leakage, and the approval trail for agent-initiated changes.
ISO 27001 baseline — Acme estateThe production payment platform, the data it holds, the vendors that touch it, and the people-process risks around release and offboarding.

Risk register

No risks were recorded in this period.

4

Decision log

Every recorded action, in the order it happened. The number is this workspace's own running count (1, 2, 3 ...); each row names who acted and when. The full record travels in the signed bundle.

#When (UTC)ActionSubjectPerformed by
12026-07-24 14:13Consent recordedconsent a4dcd06c1251f364-e38d-4360-b8be-7fea95f25206
22026-07-24 14:13Actor person addedactor 6da60e841251f364-e38d-4360-b8be-7fea95f25206
32026-07-24 14:13Actor role assignedactor 6da60e841251f364-e38d-4360-b8be-7fea95f25206
42026-07-24 14:14Skill activatedskill ff73cee2system:skill-registry-loader
52026-07-24 14:14Skill activatedskill e65053ddsystem:skill-registry-loader
62026-07-24 14:14Skill activatedskill 797f4662system:skill-registry-loader
72026-07-24 14:14Skill activatedskill b914d8d5system:skill-registry-loader
82026-07-24 14:14Skill activatedskill bc87b74csystem:skill-registry-loader
92026-07-24 14:14Skill activatedskill c84ff91bsystem:skill-registry-loader
102026-07-24 14:14Skill activatedskill c745f6edsystem:skill-registry-loader
112026-07-24 14:14Skill activatedskill f7699f61system:skill-registry-loader
122026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
132026-07-24 14:14Asset proposedasset 9c830ead1251f364-e38d-4360-b8be-7fea95f25206
142026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2503604csystem:mcp-tool-emitter
152026-07-24 14:14Mcp tool completedmcp_tool_invocation 2503604csystem:mcp-tool-emitter
162026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
172026-07-24 14:14Package createdpackage 019f947a1251f364-e38d-4360-b8be-7fea95f25206
182026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
192026-07-24 14:14Asset proposedasset 904668c01251f364-e38d-4360-b8be-7fea95f25206
202026-07-24 14:14Verifier verdictverifier_verdict a204220csystem:gateway-rule-tier-verifier
212026-07-24 14:14Mcp tool completedmcp_tool_invocation 2503604csystem:mcp-tool-emitter
222026-07-24 14:14Verifier verdictverifier_verdict 9650c1a2system:gateway-rule-tier-verifier
232026-07-24 14:14Package createdpackage 019f947a1251f364-e38d-4360-b8be-7fea95f25206
242026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2503604csystem:mcp-tool-emitter
252026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
262026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
272026-07-24 14:14Vendor proposedvendor 7eae9e201251f364-e38d-4360-b8be-7fea95f25206
282026-07-24 14:14Verifier verdictverifier_verdict eee6ba2asystem:gateway-rule-tier-verifier
292026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
302026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
312026-07-24 14:14Mcp tool completedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
322026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
332026-07-24 14:14Verifier verdictverifier_verdict 0204ce39system:gateway-rule-tier-verifier
342026-07-24 14:14Risk proposedrisk c7d5c2351251f364-e38d-4360-b8be-7fea95f25206
352026-07-24 14:14Verifier verdictverifier_verdict d835a1c3system:gateway-rule-tier-verifier
362026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
372026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
382026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
392026-07-24 14:14Verifier verdictverifier_verdict e9ca2cdcsystem:gateway-rule-tier-verifier
402026-07-24 14:14Mcp tool completedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
412026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
422026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
432026-07-24 14:14Risk proposedrisk 8c3d1a371251f364-e38d-4360-b8be-7fea95f25206
442026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
452026-07-24 14:14Vendor proposedvendor bcb3d9bd1251f364-e38d-4360-b8be-7fea95f25206
462026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
472026-07-24 14:14Verifier verdictverifier_verdict 1e26c3c0system:gateway-rule-tier-verifier
482026-07-24 14:14Verifier verdictverifier_verdict 6697b5c9system:gateway-rule-tier-verifier
492026-07-24 14:14Vendor proposedvendor ce9ff1911251f364-e38d-4360-b8be-7fea95f25206
502026-07-24 14:14Verifier verdictverifier_verdict 4abd421dsystem:gateway-rule-tier-verifier
512026-07-24 14:14Asset proposedasset 64e58e4e1251f364-e38d-4360-b8be-7fea95f25206
522026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
532026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
542026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
552026-07-24 14:14Verifier verdictverifier_verdict 3c6fc205system:gateway-rule-tier-verifier
562026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
572026-07-24 14:14Vendor proposedvendor c1f5bd931251f364-e38d-4360-b8be-7fea95f25206
582026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
592026-07-24 14:14Verifier verdictverifier_verdict 7861d8cbsystem:gateway-rule-tier-verifier
602026-07-24 14:14Mcp tool completedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
612026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
622026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
632026-07-24 14:14Asset proposedasset dc3ac95b1251f364-e38d-4360-b8be-7fea95f25206
642026-07-24 14:14Mcp tool completedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
652026-07-24 14:14Asset proposedasset 9ed5eb811251f364-e38d-4360-b8be-7fea95f25206
662026-07-24 14:14Verifier verdictverifier_verdict 0d8e61b9system:gateway-rule-tier-verifier
672026-07-24 14:14Mcp tool completedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
682026-07-24 14:14Mcp tool invokedmcp_tool_invocation 3219f66dsystem:mcp-tool-emitter
692026-07-24 14:14Vendor proposedvendor c8ef01391251f364-e38d-4360-b8be-7fea95f25206
702026-07-24 14:14Mcp tool completedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
712026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2a5f9eeasystem:mcp-tool-emitter
722026-07-24 14:14Asset proposedasset 85a86afa1251f364-e38d-4360-b8be-7fea95f25206
732026-07-24 14:14Verifier verdictverifier_verdict 73148c22system:gateway-rule-tier-verifier
742026-07-24 14:14Verifier verdictverifier_verdict 3eed90f3system:gateway-rule-tier-verifier
752026-07-24 14:14Verifier verdictverifier_verdict 5269a65fsystem:gateway-rule-tier-verifier
762026-07-24 14:14Risk proposedrisk e1698fd21251f364-e38d-4360-b8be-7fea95f25206
772026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
782026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
792026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
802026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
812026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
822026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
832026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
842026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
852026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
862026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
872026-07-24 14:14Verifier verdictverifier_verdict b3ebe326system:gateway-rule-tier-verifier
882026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
892026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
902026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
912026-07-24 14:14Risk proposedrisk 03b4000e1251f364-e38d-4360-b8be-7fea95f25206
922026-07-24 14:14Verifier verdictverifier_verdict 12ecdceasystem:gateway-rule-tier-verifier
932026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
942026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
952026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
962026-07-24 14:14Verifier verdictverifier_verdict 6b08fc3fsystem:gateway-rule-tier-verifier
972026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
982026-07-24 14:14Risk proposedrisk f1630daa1251f364-e38d-4360-b8be-7fea95f25206
992026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
1002026-07-24 14:14Mcp tool completedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
1012026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
1022026-07-24 14:14Risk proposedrisk 6a287a911251f364-e38d-4360-b8be-7fea95f25206
1032026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
1042026-07-24 14:14Mcp tool invokedmcp_tool_invocation 8231dba1system:mcp-tool-emitter
1052026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
1062026-07-24 14:14Mcp tool completedmcp_tool_invocation 2f12fe2bsystem:mcp-tool-emitter
1072026-07-24 14:14Risk proposedrisk aa18b6731251f364-e38d-4360-b8be-7fea95f25206
1082026-07-24 14:14Verifier verdictverifier_verdict b847c19dsystem:gateway-rule-tier-verifier
1092026-07-24 14:14Risk proposedrisk 803b35e31251f364-e38d-4360-b8be-7fea95f25206
1102026-07-24 14:14Verifier verdictverifier_verdict d85e4c6asystem:gateway-rule-tier-verifier
1112026-07-24 14:14Internal control proposedinternal_control 41ae1cc51251f364-e38d-4360-b8be-7fea95f25206
1122026-07-24 14:14Verifier verdictverifier_verdict a1dbb18bsystem:gateway-rule-tier-verifier
1132026-07-24 14:14Verifier verdictverifier_verdict 825118dasystem:gateway-rule-tier-verifier
1142026-07-24 14:14Verifier verdictverifier_verdict 8284ee99system:gateway-rule-tier-verifier
1152026-07-24 14:14Mcp tool invokedmcp_tool_invocation 2317438asystem:mcp-tool-emitter
1162026-07-24 14:14Policy proposedpolicy 4ccc22e81251f364-e38d-4360-b8be-7fea95f25206
1172026-07-24 14:14Mcp tool completedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1182026-07-24 14:14Mcp tool completedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1192026-07-24 14:14Policy proposedpolicy 5f54a40d1251f364-e38d-4360-b8be-7fea95f25206
1202026-07-24 14:14Internal control proposedinternal_control aeedca031251f364-e38d-4360-b8be-7fea95f25206
1212026-07-24 14:14Mcp tool invokedmcp_tool_invocation a8b89699system:mcp-tool-emitter
1222026-07-24 14:14Mcp tool failedmcp_tool_invocation 2317438asystem:mcp-tool-emitter
1232026-07-24 14:14Mcp tool completedmcp_tool_invocation a8b89699system:mcp-tool-emitter
1242026-07-24 14:14Internal control proposedinternal_control 065be2791251f364-e38d-4360-b8be-7fea95f25206
1252026-07-24 14:14Mcp tool completedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1262026-07-24 14:14Mcp tool invokedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1272026-07-24 14:14Mcp tool invokedmcp_tool_invocation a8b89699system:mcp-tool-emitter
1282026-07-24 14:14Mcp tool completedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1292026-07-24 14:14Internal control proposedinternal_control 0aaaaf0d1251f364-e38d-4360-b8be-7fea95f25206
1302026-07-24 14:14Mcp tool invokedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1312026-07-24 14:14Mcp tool invokedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1322026-07-24 14:14Mcp tool completedmcp_tool_invocation a8b89699system:mcp-tool-emitter
1332026-07-24 14:14Verifier verdictverifier_verdict 6fa4af0dsystem:gateway-rule-tier-verifier
1342026-07-24 14:14Verifier verdictverifier_verdict 30577567system:gateway-rule-tier-verifier
1352026-07-24 14:14Mcp tool invokedmcp_tool_invocation bdd95912system:mcp-tool-emitter
1362026-07-24 14:18Intake completedintake 019f947d1251f364-e38d-4360-b8be-7fea95f25206
1372026-07-24 14:18Mcp tool completedmcp_tool_invocation 5ae2afd2system:mcp-tool-emitter
1382026-07-24 14:18Mcp tool invokedmcp_tool_invocation 5ae2afd2system:mcp-tool-emitter
1392026-07-24 14:19Mcp tool completedmcp_tool_invocation d338d3d1system:mcp-tool-emitter
1402026-07-24 14:19Mcp tool invokedmcp_tool_invocation d338d3d1system:mcp-tool-emitter
1412026-07-24 14:20Mcp tool invokedmcp_tool_invocation 07615907system:mcp-tool-emitter
1422026-07-24 14:20Mcp tool completedmcp_tool_invocation 07615907system:mcp-tool-emitter
1432026-07-24 14:52Framework licence attestedframework_licence b99d638e1251f364-e38d-4360-b8be-7fea95f25206
1442026-07-24 15:00Deliverable charge consenteddeliverable_charge 0e3066f9system:billing-gate
1452026-07-24 15:00Completeness override recordedcompleteness_override f6ab265e1251f364-e38d-4360-b8be-7fea95f25206
6

Integrity and verification

How to satisfy yourself this pack is genuine
  1. Verify offline. The signed bundle this page came from includes the full record, the public verification key, and a self-contained verification tool. Your technical reviewer runs it on their own machine to confirm the seal, with nothing sent to anyone.
  2. What it confirms. That the record is intact and nothing was changed after it was sealed; that every recorded change was checked before it took effect; that the person who proposed a change was not the person who approved it; and that each decision carries the detail needed to re-check it.
  3. Reconcile to source. The seal proves the record is the complete set captured during the period and unaltered since. It does not, on its own, prove every event reached the system in the first place, so each record names the source it was drawn from for independent reconciliation.

How this evidence was produced

Policy and control text was drafted with assistance and approved by a named, accountable person. Operating evidence is generated by source systems and performed by people; no operating evidence is machine-generated, and no test conclusion is automated. An automated check runs before each record is approved to confirm it is well-formed and maps to its stated requirement. It is a quality gate, not an opinion on whether a control operates effectively.

019f9479 - SEALED 2026-07-24T15:00:57Z CHAIN HEAD 4a199bf47065...3e5df0e7 - 145 RECORDS