Audit Integrity
What this screen is for
Every audit record is signed when it is written and linked to the record before it, so that a record altered or removed afterwards can be detected. This screen answers whether that has happened: it shows the standing verdict of the verification that re-checks the stored records, lets you start a verification, and lists what each run found. Verification detects and reports. It never modifies an audit record, so nothing on this screen changes the trail.
The records are kept as chains, one per tenant and record type. The five record types are cryptographic operations, administrative changes, authentication, PQC handshake and audit access, and administrative, authentication and audit-access records also form a platform-wide chain that belongs to no tenant. A verdict is given per chain, and the headline is the worst of them.
What must exist first
This is a platform screen, reached in the platform context. Before you work here:
- The permission to read platform audit integrity, which shows the sidebar entry and the whole screen. The platform super administrator and auditor roles hold it; the platform viewer does not. Without it the screen states which permission it needs.
- The permission to verify platform audit integrity, for Run verification and Verify this chain. Without it the button is disabled and names the permission. Only the platform super administrator holds it.
Verification also runs on a schedule, every six hours unless your deployment set another cadence, and each pass visits at most 500 chains and spends at most 5,000 records on each, resuming from the position the previous pass reached. A deployment can disable the schedule; then the only runs are the ones started here, and the Run history tab is where their absence shows.
Decisions you make here
Reading the verdict
The band under the title is one of four states:
- Verified intact: every chain with a recorded run reached its last run without a break. When any chain begins after its origin because the retention policy removed older records, the band says from when the verdict covers events and that this is normal, scheduled behaviour; the removal is attested by a signed retention record and is not a break.
- Not yet verified: no run has ever decided anything. This is not a problem and not a pass; it means nobody has checked.
- Integrity break detected: at least one chain's last run found a break, and the band counts the affected chains. One broken chain makes the headline broken however many intact chains sit beside it.
- Integrity status unavailable: the status could not be read. The records themselves are unaffected.
Below it, the coverage measure: how many chains have a recorded run, of how many chains were counted to exist and when that count was taken. The two numbers are measured at different moments and are never turned into a percentage. A run that stopped at its budget contributes as Intact within the range covered, which means nothing found yet, not nothing to find.
What is verified? lists the five checks a run performs on every record it reaches: the record still matches its own signature; it still links to the record before it; no position in the sequence is missing or repeated; the first record of each chain is the genuine start; and any removal at the start of a chain is backed by a signed retention record. Only the first of these can catch a record whose content was rewritten in place, because the chain binds where a record sits and not what it says; only the others can catch a record that was moved or removed.
Understanding a break
A break is reported with its kind, the sequence position where it was found, the position expected there, when the previous verified record was written, and the run that found it. The kinds are: Missing record, Repeated position, Link mismatch, Record altered, Signature mismatch, Missing origin, Second origin, Unattested prefix gap and Invalid retention marker.
Record altered means the record or its position no longer recomputes under the chain key; Signature mismatch means the record's own signature no longer matches its content. A record that names a signing key or a format the platform does not hold is reported as a mismatch, never skipped.
Copy details puts these facts on the clipboard. What you do with them is outside this screen: the verdict stays broken until a later run over the same range finds the chain intact, and since verification repairs nothing, that happens only when the records are restored outside the platform.
Running a platform verification
Run verification starts a walk over every chain, under the same budget as the schedule, and returns at once; the button reads Verification running… and the count of records verified advances while it walks. A frozen counter is a stalled run, not silence.
When a run is already in flight the request joins it instead of starting a second one. When the walk ends the screen announces one of four outcomes: complete, a break detected, interrupted before it covered the whole range, or finished without examining any chain, which says nothing about the trail. Running again resumes from the last verified position.
Verifying one chain
On the By tenant tab, Verify this chain walks one tenant's chain on one record type while you wait and shows the full report: records checked, signature failures, the range covered, and the conditions under which this verdict could report a break that is not one or would not detect a change at all. Re-check from the start of the chain ignores the recorded checkpoint and proves the whole chain again; it is slower and the only way to audit the checkpoint itself. The platform tenant's chains and the platform-wide chains cannot be addressed this way and read Covered by the platform run.
Reading the breakdown and the history
By tenant lists every chain with a recorded run, its integrity, its run status and when it was last verified, filtered by record type. Run history lists runs newest first, 25 per page, with their scope, status, verdict, records verified, whether they were Scheduled or started by an Operator, and, for a broken run, where the trail broke. A run whose status is Interrupted speaks only for the range it reached.
How it relates to other screens
The verdict for the audit-access chain is projected on the Attest tab of Audit Access, and each tenant's Audit Log shows the state of its own chains beside its title, read-only:
The tenants named on the By tenant tab are those of the Tenants screen: