Audit and incident handoff

Give auditors and incident reviewers records they can check themselves.

Package the relevant signed records for an incident, customer review or audit so another party can inspect them separately.

evidence-bundleillustrative export
Case
ref INC-2026-0417
Records
4 supplied
Artifacts
2 references
Missing
delivery observation
Case digest
sha256:6f0a3c...
records require individual verification
Signed recordsNative artifactsIntegrity digestsOffline verification
The problem

A screen recording is not something a reviewer can check.

An audit, a security incident, or a partner review usually comes down to one request: show us what happened without giving us access to your systems. A handoff bundle answers these questions:

  • Which records and artifacts are relevant to the reviewed action or incident?
  • Which incident or review reference was the bundle assembled for?
  • Is the bundle complete and unaltered since it was assembled?
  • Can a reviewer check the signatures against a key they were told to expect?
  • What does the bundle not establish about the underlying incident?
The specimen

What the bundle for one incident contains.

Create the bundle
{
  "case_ref": "INC-2026-0417",
  "records": 4,
  "artifacts": 2,
  "missing": ["delivery_observation"]
}

Select the relevant signed records, native artifacts, issuer-key information, and review reference. Originary's pilot defines and implements this export for the selected workflow.

Verify the included records, offline by default
npx -y @peac/cli@0.16.4 verify \
  ./records/gateway-decision.jws \
  --public-key ./jwks.json

Each supplied record is verified independently, with the public key or JWKS the reviewer was told to expect. Case-level completeness and evidence sufficiency are assessed separately. Nothing is uploaded to Originary.

What it contains

What the reviewer receives.

  • The signed records relevant to the reviewed action or incident.
  • Native artifacts or references the records point to.
  • The incident or review reference the bundle was assembled for.
  • A verification report, generated at assembly time.
  • An integrity digest over the exported bundle contents.
Boundaries

What Originary does not do here.

  • It does not run your audit or incident-response process.
  • It does not decide what should have been recorded.
  • It does not store the bundle or the records inside it.
  • It does not require your reviewer to have an Originary account.
  • It does not need your raw logs.

Hand off one bundle the next time a reviewer asks.

Pick a review or incident someone has already asked you about, and we will define the bundle with you.