End-to-end governance workflow.
From artifact creation through runtime governance to offline-verifiable evidence. Eight steps, cryptographically proven.
Artifact Creation
At approval time, a governance artifact encodes integrity parameters, permitted operations, measurement rules, governance policies, and validity period. Ed25519-signed; tamper-evident once sealed.
System Launch
The Governance gateway verifies the Policy Artifact signature, confirms time validity, and parses governance parameters. Any failed check seals a denial decision; the handler that blocks execution is wired per deployment. Default state is denial.
Initial Measurement
The portal computes an initial integrity measurement and compares it to the sealed baseline. A mismatch seals a denial decision; the handler that blocks execution is a per-deployment integration point.
Continuous Monitoring
During execution, the portal measures at the cadence the artifact specifies: binary integrity, configuration, dependency checksums, environment metadata, and system telemetry.
Drift Detection
Any deviation from the sealed baseline is caught through deterministic hash comparison. The portal identifies which measurement class triggered the mismatch.
Governance Decision
The portal renders the artifact-defined decision and seals it as a signed receipt. At the agent boundary that is TERMINATE, QUARANTINE, or ALERT_ONLY; for safety-critical systems it emits an attested SAFE_STATE decision the control system carries out. The handlers that effect the action are integration points wired per deployment.
Receipt Generation
Every decision generates a signed receipt: measurement result, policy decision, timestamp, previous receipt hash, portal signature, hash-linked into a tamper-evident chain.
Evidence Bundle & Verification
Execution produces a portable bundle: the governance artifact, the receipt chain, Merkle inclusion proofs, and checkpoint references. Anyone can verify it offline.
End-to-end trace.
All hashes truncated. Sample data from the reference implementation drone governance scenario.
Read the architecture behind each step.
The technology overview walks through every cryptographic primitive, every governance mode, and every verification step the gateway takes between artifact seal and evidence bundle.