Skip to main content

​
Overview

Parmana produces auditable evidence for every stage of policy enforcement. Audit records allow organizations to answer:
  • What decision was made?
  • Which policy produced the decision?
  • Which verified signals were evaluated?
  • Was an override applied?
  • Was the action executed?
  • Did execution match authorization?
  • Can the evidence be independently verified?
Verified Signals
        ↓
Policy Evaluation
        ↓
Attestation
        ↓
Override (optional)
        ↓
Execution
        ↓
Execution Integrity Proof
        ↓
Verification

​
Why Audit Matters

Policies are only useful if organizations can demonstrate that they were enforced. Parmana creates evidence that can be inspected later by:
  • Auditors
  • Compliance teams
  • Security teams
  • Risk teams
  • Regulators
  • Customers

​
Core Principle

Parmana records evidence instead of requiring trust. 
Action
    ↓
Evidence
    ↓
Verification
Every important step produces verifiable records.

​
Audit Lifecycle

Customer Request
        ↓
Verified Signals
        ↓
Policy Evaluation
        ↓
Attestation
        ↓
Override (optional)
        ↓
Execution
        ↓
Execution Integrity Proof
        ↓
Verification
Each step contributes evidence to the audit trail.

​
Evaluation Records

Policy evaluations generate signed attestations. Example: 
{
  "executionId": "claim-001",
  "policyId": "claims-approval",
  "policyVersion": "1.0.0",
  "decision": {
    "status": "decided",
    "outcome": {
      "action": "approve",
      "requires_override": false
    }
  },
  "signature": "..."
}
The attestation becomes the primary authorization record.

​
Override Records

When a policy requires escalation: 
{
  "status": "pending_override",
  "requires_override": true
}
Parmana records:
  • Approver identity
  • Approver role
  • Approval reason
  • Override signature
Example: 
{
  "approvedBy": "manager",
  "approverRole": "manager",
  "reason": "manual review completed"
}
Overrides never replace the original policy decision. Both records remain available for audit.

​
Execution Integrity Proofs

After execution, organizations can confirm what actually occurred. 
Attestation
        ↓
Execution
        ↓
Confirm Execution
        ↓
Execution Integrity Proof
Example: 
{
  "match": true,
  "verified": true,
  "execution_state": "completed"
}
Execution Integrity Proofs demonstrate:
  • What was authorized
  • What was executed
  • Whether they matched

​
Verification Records

Verification produces independent evidence that an attestation is valid. Verification checks:
  • Signature validity
  • Runtime compatibility
  • Schema compatibility
  • Provenance integrity
  • Release integrity
Example: 
{
  "valid": true,
  "signatureVerified": true,
  "runtimeVerified": true,
  "schemaCompatible": true
}

​
Provenance Records

Every attestation includes provenance metadata. Example: 
{
  "provenance": {
    "provenanceVersion": "PARMANA_PROVENANCE_V1",
    "bundleHash": "...",
    "manifestHash": "...",
    "trustRootVersion": "1.0.0",
    "signerKeyId": "parmanasystems-root-2026"
  }
}
Provenance links decisions to:
  • Runtime artifacts
  • Release manifests
  • Trust roots
  • Signing infrastructure

​
Evidence Categories

​
Authorization Evidence

Produced by: 
POST /evaluate
Includes:
  • Policy decision
  • Signals fingerprint
  • Attestation signature

​
Override Evidence

Produced by: 
POST /override
Includes:
  • Human approval
  • Role
  • Reason
  • Override signature

​
Execution Evidence

Produced by: 
POST /confirm-execution
Includes:
  • Authorized action
  • Executed action
  • Match analysis
  • Integrity proof

​
Verification Evidence

Produced by: 
POST /verify
Includes:
  • Verification outcome
  • Trust chain validation
  • Provenance validation

​
Audit Database

When audit persistence is enabled, Parmana stores audit records for operational and compliance purposes. Typical records include: 
Decisions
Overrides
Verifications
Execution Confirmations
Audit persistence is optional. Cryptographic evidence remains portable even without a database.

​
Portable Evidence

Parmana evidence can be stored independently. Examples: 
Object Storage
Archive Systems
Compliance Platforms
SIEM Systems
Regulatory Archives
Evidence remains verifiable outside the original runtime.

​
Example Audit Trail

Customer submits request
        ↓
Policy evaluated
        ↓
Attestation issued
        ↓
Override approved
        ↓
Action executed
        ↓
Execution confirmed
        ↓
Verification performed
Result: 
Complete Authority Trail

​
Independent Audit

An auditor should be able to answer: 
Which policy was evaluated?
Which signals were used?
Who approved the override?
What action was executed?
Did execution match authorization?
Can the evidence be verified?
without trusting the original runtime.

​
Authority Trail

Parmana records the complete authority chain. 
Verified Facts
        ↓
Policy Evaluation
        ↓
Decision
        ↓
Human Override (optional)
        ↓
Execution
        ↓
Execution Integrity Proof
        ↓
Verification
This creates a verifiable record of how authority was exercised before and during execution.

​
How Runtime Audit Fits Into Parmana

Verified Signals
        ↓
Parmana Evaluation
        ↓
Attestation
        ↓
Override
        ↓
Execution
        ↓
Execution Integrity Proof
        ↓
Verification
        ↓
Audit Evidence
Parmana does not merely record events. Parmana records verifiable evidence showing how authority was exercised, enforced, and confirmed.