Governed Changes and Audit¶
How a Network Authority records the changes reported to it, judges changes made outside the controlled path, settles them, authorises changes in advance for devices that cannot reach it, and hands a security team an audit it can verify on its own.
Each part is off by default, and each needs the one before it:
Setting |
Turns on |
Needs |
|---|---|---|
|
the evidence store: decisions, execution evidence, anchors, audit packs, archives |
— |
|
observations, break-glass records, judgements; edge nodes |
|
|
remediation, reviews, the emergency capability |
|
|
pre-issued grants |
|
The NA records only what is reported to it, through execution evidence or observations. A change nobody reports is found only against a log kept elsewhere (the completeness check in Verifying a Pack).
On the client side, the outbox, observations, break-glass, the remediation helpers and grant holders exist only in the TypeScript and Rust SDKs and in the edge agent. The Go and .NET SDKs verify records and grants but do not make them.
Changes made outside the controlled path: observers, break-glass, judgements, remediation, reviews and the emergency capability.
Changes authorised in advance for devices that cannot reach the NA: pre-issued grants and the edge agent.
Anchors, retention and archives, audit packs, and verifying them with the Python and Rust verifiers.
Replacing the NA key by succession, and the ceremony that keeps the root key offline.