Skip to content

The verification act after the fact

Every consequential decision is designed to be defended later.

The hardest question in security governance arrives months after the decision: why was this release cleared? Why was this finding suppressed? Why was this override granted? GoSentrix produces decisions designed to answer those questions with the evidence, policy, and trust state that were active at the moment the decision was made.

What enters

An audit defense round begins not with a query but with a decision in question:

  • A specific decision_id — a merge readiness decision, a release decision, a fix verification record, an override authorization
  • The replay command captured at decision time
  • The decision record's bound policy_version and policy_digest
  • The evidence snapshot, freshness snapshot, and trust state that were active at the time
  • Any subsequent actions taken against the decision — overrides, downgrades, replay-based re-verifications

How GoSentrix verifies

Step 1

Locate the decision.

Every consequential decision carries an immutable decision fingerprint and content-addressed bundle ID. The decision is locatable years later, not by search but by identity.

Step 2

Bind to the right policy.

The decision was bound to a specific policy version at the time it was made. That binding is not retroactively updated when policy changes. Replaying the decision against today's policy is a different operation than defending the decision that was made.

Step 3

Reproduce.

The replay command, with the bound evidence and policy version, reproduces the decision. Replay proves reproducibility, not correctness — but reproducibility is what makes the decision a decision rather than an opinion.

Step 4

Show the chain.

Override authorizations, downgrade ledger entries, and prior verification rounds are visible alongside the decision. An auditor sees not only the verdict but the chain that produced it.

Step 5

Surface what was missing.

If GoSentrix downgraded its own authority on this decision, the downgrade is on the record, with the reason. The system does not pretend authority it did not have.

What is produced

Artifact
What it carries
Immutable decision record
Decision fingerprint, evidence snapshot, freshness snapshot, replay command
Policy binding
The policy_version and policy_digest active at decision time
Replay artifact
Reproduces the decision against the inputs that produced it
Downgrade ledger
Where GoSentrix narrowed its own authority, and why
Override chain
Typed approval records, where applicable
Workspace signed bundle
Aggregate evidence references for release decisions; content-addressed

Which claims this proof supports

GoSentrix produces decisions designed to be defended later.
Replay proves reproducibility against the original inputs.
Policy binding prevents later policy edits from rewriting decision history.

Replayability is the line

Replayability is the line between opinion and decision.

A finding that was suppressed without an evidence basis cannot be defended. An override that was granted without an approval chain cannot be defended. A release that was cleared without a bound policy version cannot be defended.

Every consequential GoSentrix decision is designed to be on the defensible side of that line.

What this does not do

Audit-grade defense does not establish perfect audit history forever. Replay is bounded by retention and by decision-contract version — decisions made under an earlier contract version may not replay under the current one. We say what is supported and what is not.

Replay proves reproducibility. It does not prove the original decision was correct under standards that did not exist at the time. The defense is: this decision was made under this policy, against this evidence, and it can be reproduced. Whether the policy was right is a separate question, and it is your organization's question, not ours.

Every consequential decision is designed to be defended later. | GoSentrix