Decisions & Evidence

Decision traces

Every decision produces a complete trace: every rule, every predicate value, every resolved object version, every attestation. The trace root is bound into the admission decision.

The trace is a structured artifact whose content-address travels with the decision through receipts, audit, and replay. Because evaluation is total, the trace covers the entire rule set, including unmatched rules, so a reviewer can inspect the admitted path and the inactive forbid paths.

Predicate values in the trace respect the display schema's trust levels: verified fields render as values, fields marked redacted render as commitments. Trace access is scoped to authenticated operators and auditors of the tenant.

Trace structure

EvaluationOutcome (allowed operation)
json
{
  "decision": "ALLOW",
  "derived_level": "Quorum",
  "policy": { "bundle_id": "pb_7f3a", "version": 42,
              "package_root": "cid:…", "schema": "custody/v3#9c41" },
  "snapshot": { "eval_time": "2026-07-01T14:22:07Z", "id": "snap_0e12" },
  "matched_forbids": [],
  "matched_permits": [{
    "rule": "treasury-large-transfers",
    "control": "CTRL-PAY-004",
    "predicates": [
      { "text": "operation == Sign", "value": true },
      { "text": "amount > USDC 10_000", "value": true,
        "observed": "USDC 62_000.00" },
      { "text": "destination in set treasury_counterparties",
        "value": true, "set_version": 9 }
    ]
  }],
  "obligations": [
    { "kind": "approval", "group": "treasury_officers", "threshold": 2,
      "expires": "2026-07-01T18:22:07Z", "source": "treasury-large-transfers" },
    { "kind": "approval", "group": "risk_office", "threshold": 1,
      "source": "treasury-large-transfers" },
    { "kind": "meter", "meter": "tenant_daily_notional",
      "reserved": "USD 62_013.40", "headroom": "USD 3_487_120.11" }
  ],
  "resolved_objects": [
    { "set": "treasury_counterparties", "version": 9, "root": "cid:…" }
  ],
  "attestations": [
    { "oracle": "usd_rates", "pair": "USDC/USD", "rate": "1.000216",
      "signed_at": "2026-07-01T14:21:44Z", "root": "cid:…" }
  ]
}

Trace envelope

The envelope binds package, schema, snapshot, context, trace body, rendered sentence roots, and display view. The same envelope shape is used by admission, replay, simulation, and shadow records.

DecisionTraceEnvelope
json
{
  "operation_id": "op_7f3a",
  "package_root": "cid:pkg_v43",
  "schema_root": "cid:schema_custody_v3",
  "context_root": "cid:ctx",
  "snapshot_root": "cid:snap",
  "trace_body_root": "cid:trace_body",
  "rendered_sentences_root": "cid:rendered",
  "display_view": "Operator",
  "trace_root": "cid:trace"
}

Guarantees

  • The trace root is a mandatory field of the AdmissionDecision.
  • Replaying the package over the recorded context and snapshot reproduces the trace byte-for-byte.
  • Match statistics shown in the console ("matched 1 204 times in 30 days") are projections over recorded traces.

Rendered views

The display schema maps each trace field to Operator, Auditor, or External views. Values, commitments, and redacted markers are computed from the trace and the display schema before API serialization.