Evidence an auditor
can actually follow.

A realistic redacted artifact. Real packs are generated in your environment and stored in your S3 bucket.

Evidence Pack
evp_2026052814320400
✓ SEALED
Identityjane.doe@acme.gov
Request IDreq_8f3a91c2d4e6b0fa
Signal sourceWorkday HCM — termination webhook
Signal time2026-05-28 14:31:54Z
Policyleaver-full-revoke-v3 · auto-approved
TargetsActive Directory · AWS IAM · Okta
Approversecurity-team@acme.gov (policy auto)
Before stateActive · 3 active keys · org member
After state✓ Disabled · 0 active keys · removed
VerificationLDAP read-back · IAM API list · Okta status
Completed2026-05-28 14:32:08Z · illustrative sample
RetentionCustomer — acme-evidence-prod · us-east-1
Evidence hash
sha256:a3f5c2e1b8d7f9a0c4e6b5d8a2f1e3c7b8d1a3e5
Prev hash 7c2e1a48b7f9d3e6c4f6b8d1a2e5c0f3…a9d4b2e1 · chain #4,847
Signed · ECDSA P-256 · customer-held key · S3 Object Lock Compliance Mode Illustrative — values are representative
Evidence an auditor can actually follow

Each pack includes: source signal, policy decision, pre/post-state per target verified by read-back, hash-chain reference, and ECDSA signature using a customer-held key.

Written to S3 Object Lock in Compliance Mode. Export formats: JSON · PDF · CSV.

This is a public-safe illustrative sample. Real Evidence Packs are generated and stored in your own environment.