Auditor evidence pack
Expense report at itinerary
Administration · Travel & Expense · line AD3A · Trip Request to Booking. This pack names every action taken on this unit, who or what took it, the authority that permitted it, and the model, prompt and policy versions in force at that moment.
Every record links to the one before it and hashes to its stored value. 5 records were re-hashed on this page load, in order, starting from the genesis value. Nothing was read from a cached verdict.
hash = sha256(prevHash + "|" + JSON{seq, unitRef, actor, action, outcome, occurredAt})
The unit
What the work was, and where it sits
Every action, in order
Actor, authority, versions in force, and the hash link to the record before it
Cleared policy check
Cleared price options
Cleared approve
Cleared book
Holding at itinerary
Authority relied on
Who was allowed to do this, up to what value, in which jurisdictions
Any unit on a travel & expense line where every intake check passed, the policy in force is current, and the value sits inside the cap below.
Anything the agent grant refuses, plus any override of an agent outcome. An override must state what the agent concluded and why it is being set aside.
Versions in force
Exactly what was running when these actions were taken
| Kind | Identifier | Version | Status | Owner |
|---|---|---|---|---|
| model | extract-lite | 2.9 | current | Platform model council |
| policy | materiality-bands | v9 | current | Group controller |
| prompt | task-execution | p21 | current | Shared service engineering |
| toolset | ledger-write | t7 | current | Finance systems |
| toolset | read-only-lookup | t12 | current | Platform engineering |
| toolset | document-fetch | t9 | current | Shared service engineering |
Gates on this line
The control points this unit had to clear
Records schedule and holds
How long this evidence must be kept, and whether it is frozen
What this pack proves, and what it does not
Read this before you rely on it
- Every action carries a named actor, an actor kind, and a timestamp.
- Every action names the authority grant that permitted it and the cap that grant carries.
- Every action stamps the model, prompt, policy and tool versions in force at that moment.
- Corrections are additive. A later record supersedes an earlier one and says why; the earlier record is never edited or deleted.
- The chain is re-hashed live on this page, so a single altered field is detected immediately.
- It is not tamper-proof against an attacker with write access to the store, who could rewrite the whole chain from genesis. Making that impossible requires publishing chain tips to a store this application cannot write to. That anchor is not built, and this page does not claim it.
- The evidence in this demonstration is modeled from a simulated estate, not captured from production systems.
- Identity here is the actor name recorded on the action. Cryptographic agent identity and signed attestation are a separate piece of work.