Process and evidence integrity
Institutional · Decision Passport
Decision Passport
A Decision Passport is a signed, self-contained record of how a decision or an analysis was produced: what evidence it rests on, which frozen engine produced it, who proposed and who reviewed it, and when. Anyone can check it offline, with no account and no trust in this website, by recomputing every hash and verifying the signature against a pinned public key.
Passports are issued here only after a two-person review in a private workspace, and are signed on the server. This section sets out what a passport means, how it is made, how to check one, and the rules that govern issuance.
1.What a passport attests, and what it does not
The same lists are written into every Deep Analysis passport, so the meaning travels with the record.
It attests
- The bound Deep Analysis report (identified by its SHA-256 seal) existed in this form when the draft was created.
- Each finding listed here cites spans whose quotes hash to the recorded SHA-256 values.
- The analysis engine, the AI model and prompt version (if any) and the passport policy version that applied.
- Who proposed and who reviewed the passport (account ids; email addresses only with consent) and when.
- That the review followed the two-person rule, and the order of events in the audit trail.
It does not attest
- That the findings, the rating or any conclusion are legally or factually correct.
- That the document is complete, authentic or binding, or that any party agreed to it.
- Legal validity, a qualified electronic signature, certification or approval by any authority.
- The identity of a person beyond the sign-in account (no identity proofing).
The SHA-256 hash shows the passport is unchanged; the Ed25519 signature shows it was issued by the holder of the published key. Neither shows that the content is correct.
2.Kinds of passport
All three share one bundle format (schema 1.0.0) and are checked by the same verifiers. Each is produced by a frozen, hash-pinned engine.
| Kind | Produced from | Engine | Engine source SHA-256 |
|---|---|---|---|
| Decision Room passport | Decision Twin evaluation of a published case: rules, Adversarial Chamber, contradiction map. | dt-engine-1.0.0 | 9e4eae8ae339afde… |
| Workspace decision record | A decision in a private workspace, citing passages of imported documents, approved by a second person. | am-workspace-record-1.0.0 | 8e0d87775778f6e6… |
| Deep Analysis passport | A sealed Deep Analysis report: findings with hash-anchored spans, engine and model, two-person review. | am-da-passport-1.0.0 | e4aeeaee88bf75c5… |
3.Lifecycle
Every step is one atomic database write together with its audit event; no step can be skipped or undone.
- DraftA member binds a sealed Deep Analysis report. Nothing is signed.
- Evidence-boundReport hash, file and text hashes, findings and span hashes are fixed in the draft.
- Two-person reviewSubmitted by the proposer; approved or rejected by a different editor.
- Issue and signThe server builds the passport from the stored record and signs it.
- VerifyAnyone checks it here or offline; the registry confirms issue.
- Supersede or revokeA correction is a new passport; the old one is revoked publicly.
Who can do what
| Step | Who | Enforced by |
|---|---|---|
| Create a draft from a Deep Analysis report | Any workspace member, signed in | Server re-verifies the report seal and every span; rules require createdBy = the caller |
| Submit the draft for review | The proposer only | Server and rules |
| Approve or reject | A workspace editor who is not the proposer | Server and rules (two-person rule; self-approval refused) |
| Issue and sign | The proposer or the reviewer, after approval | Server only: the signing key never leaves the server; refused if no key is configured |
| Verify | Anyone, online or offline | Two independent verifiers (TypeScript, Go) and the public registry |
| Revoke or supersede | A workspace editor | Server and rules; the revocation is public and permanent |
Two-person rule: a passport draft is proposed by one workspace member and approved or rejected by a different member holding the workspace role editor. Only an approved draft can be issued, and only the server signs it.
4.Checking a passport
| Verification portal | Paste or upload a bundle, or give a passport ID or hash: a verdict with every check explained. |
|---|---|
| Anatomy | A real sample passport, annotated artifact by artifact. |
| Keys and key history | The pinned public key, its validity window and the rotation and compromise procedure. |
| Revocation list | Every revoked or superseded passport, as a signed list. |
| Offline verifier | A standard-library Go program that checks a bundle with no network access. |
5.Policy, audit and standards
Issuance follows the Passport Policy, version am-passport-policy/1.0.0 (SHA-256 04920df9e970ddd3…); every passport names the policy version and digest that applied. Each passport carries its own append-only audit trail. A standards mapping relates the controls to eIDAS concepts, ISO/IEC 27001, the EU AI Act and SOC 2: it is a mapping, not a certification.
Disclaimer. A passport attests to process and evidence integrity, not legal correctness. It is not legal advice, not a qualified electronic signature or seal, and not a certification; no regulatory approval is claimed.