provisioning records

Keep a record when automation changes your infrastructure.

Accounts created. Credentials rotated. Resources deployed. Subscriptions changed. Keep a signed record of what the system reported changing and when.

provisioning-eventverified offline
Issuer
https://platform.vendor.example
Event
created - deployment
Resource
prj_4fd2 - production
Actor
deploy-agent-v2
Signature
Ed25519 91bc44a0...
sample record - demo signature
Provisioning eventsCredential lifecycleBudgets and subscriptionsVerifies offline
The problem

Provisioning happens everywhere. The audit trail does not travel.

Deployments, provider setup, and credential changes are spread across consoles, CLIs, and CI. Each log is internal. A signed record answers the questions that cross the boundary:

  • Who or what created the account, resource, or deployment?
  • Which policy, budget, or subscription applied at that moment?
  • Was the credential issued, rotated, or revoked, and when?
  • Which agent or workflow made the change?
  • Can any of this be verified later, without console access?
The specimen

One provisioning event. One signed record.

provisioning-eventverified offline
Issuer
https://platform.vendor.example
Event
created - deployment
Resource
prj_4fd2 - production
Actor
deploy-agent-v2
Policy
budget:v4 sha256:2ce1a9...
Time
2026-07-02T08:41:19Z
Signature
Ed25519 91bc44a0...
sample record - demo signature
Verify on any machine, later
$ npx -y @peac/cli@0.16.4 verify ./provisioning-event.jws --public-key ./jwks.json
Signature valid (offline).
Tamper case

Change the resource, the actor, or one character of the signature and verification fails with E_INVALID_SIGNATURE.

Record the change. Never the secret.

What it covers

Lifecycle events across the stack you already run.

Deploys and runs
Vercel deploymentsGitHub Actions runsTerraform appliesDeployments
Accounts and credentials
Provider setupAccount creationCredential issuance and rotationDomains
Budgets and lifecycle
BudgetsSubscriptionsResource lifecycle: created, updated, removed

Examples are composition surfaces, not partnership claims. The record format is the same everywhere: facts, policy, result, time, issuer, signature.

Boundaries

What Originary does not do here.

  • It does not provision or deprovision anything.
  • It does not manage credentials or secrets.
  • It does not replace your infrastructure-as-code, CI, or CD.
  • It does not gate or approve deployments.

It records what the issuer reported, so another party can verify it.

The profile rejects credential-value fields. Integrations must still ensure secrets do not enter free-form, extension, log, or external-reference fields.

Add records to one provisioning workflow this week.

npx -y @peac/cli@0.16.4 verify ./provisioning-event.jws --public-key ./jwks.json
Logs stay local. Signed records travel.