When outcomes are disputed, institutions need records.

A decision is later questioned (policy complaint, regulatory inquiry, internal audit). Logs exist, but verification requires a stable record with explicit scope.

• Policy-scoped inputs and context required for review (no implicit expansion).
• Policy identifier + version (and policy hash where used) to bind scope.
• Canonical payload + digest + signature for tamper-evidence.

• Artifact integrity (not modified since sealing).
• Provenance (signature valid under declared key reference).
• Scope boundary (policy alignment is checkable).

A safety incident requires board review. The question is not “what logs say,” but what can be independently validated about the recorded context.

• Policy-scoped event inputs and bounded runtime context.
• Time anchoring (timestamp) within the artifact wrapper.
• Sealing status (sealed/unsealed) without blocking inference by default.

• Integrity and provenance where sealing succeeded.
• Clear, reportable exceptions where sealing did not succeed.
• Scope boundaries enforced by policy version references.

A recommendation influences a consequential decision. Later, an appeal or review challenges what factors were in scope at the time of inference.

• Policy-defined factors (captured, excluded, or masked) with tier designation.
• Canonical structure to support recomputation without interpretive variance.
• Integrity fields for tamper evidence and provenance checks.

• Artifact has not been modified since sealing.
• Artifact originated from the declared source under the declared key reference.
• Capture scope is bounded by recorded policy identifiers.

A reviewer needs a defensible record without forcing disclosure of proprietary system internals. Oversight requires verifiability under constrained disclosure.

• Policy-scoped artifacts that can be disclosed under tiered access.
• Stable schema + canonicalization version for future verification.
• Integrity sealing to support formal review workflows.

• Integrity and provenance under the declared key custody framework.
• Policy alignment (scope boundary) as recorded at capture time.
• Reportable integrity exceptions on verification failure.