Reading the evidence
Who authorized what? Start with the receipt.
Use this guide alongside an actual shared receipt. The explanation below describes how to inspect evidence; it does not fetch an artifact or report a verification result.
Action and resource
What was authorized?
Match the action, commit, and target to the change under review. A different commit or resource needs its own authorization.
Approver and attribution
Who approved it?
Read the identity and credential lane recorded in the signed payload. Check that the approver had authority for this decision. Do not infer a named human from an API-key actor alone.
Policy and timestamp
Under which rules, and when?
Check the recorded policy and authorization time. Compare them with the workflow requirement and the execution timeline.
Signature and issuer key
Is this the signed record?
Verify the exact signed bytes against the issuer key, and establish why you trust that key. A successful check supports authenticity and integrity of those bytes; it does not independently establish that every claim in them is true.
Keep the conclusions within the evidence.
- Approval evidence does not prove execution succeeded or that the action was safe.
- A valid signature does not prove the configured gate covered every possible execution path.
- Matching the signer, policy, and action still requires review of the signed fields and the surrounding authorization process.
- A local decision log or payload hash alone is not an independently signed receipt.
- Your reviewer determines whether the record satisfies their evidence requirement.