Audit, receipts and governance rules
What the app records for every action, how receipts work, and the rules that apply everywhere.
All agency users · Audit reader
/pdcc/admin/access-history Live walkthrough · Audit, receipts and governance rules
What is recorded
- Every command records the actor, time, reason (where required), the version it was based on and the committed version.
- Tasks keep a full history: created, reassigned (from/to), delegated (to/until), due changed (from/to) and completed (outcome note).
- Decisions bind to the exact package version and digest, the reviewer and the authority used.
- Associations, conflicts and resolutions keep both values and who decided.
Receipts
| Step | Receipt proves | It does not prove |
|---|---|---|
| Save / commit | The change is stored at a version. | Anyone was notified. |
| Notification delivery | The provider accepted the message. | It was read or acted on. |
| Transfer / handoff | The package was sent. | It was validated or accepted. |
| Acceptance | The receiver accepted that version. | It was filed officially. |
| Download | A copy was produced. | Filing. |
| Official filing | The configured official system confirmed it. | — |
| Automation activation | Scheduling succeeded. | A first run or delivery happened. |
Rules that apply everywhere
- Authentication is not authorization; a persona never grants access.
- Role labels are not legal authority — warrants and designations are checked per decision.
- Separation of duties — preparers and submitters cannot decide their own packages; nobody approves their own access.
- Preparing is not executing — the app never executes awards, modifications, payments or filings.
- Unknown is not zero — missing data stays unknown, unverified or not demonstrated.
- Nothing is silently overwritten — new source versions, template updates and edits create new versions.
- Retries are safe — partial operations report per-step results and retry only confirmed failures with the original operation identity.
- Module changes keep history — disabling a module stops new work without deleting records.
Note — Audit readers export authorized audit evidence from access history. Exports never contain secrets.
Related guides
Key concepts
Workspace, assignments, scopes, authority, evidence lanes, versions, receipts and the synthetic profile — the vocabulary used on every screen.
Access requests, effective access and access history
Approve or return bounded requests without self-elevation, simulate effective access, and review grants, expiry and removals (UA04–UA06).
Shared exception states
Empty results, validation errors, concurrent changes, denials, source outages, quarantine, partial saves, retained history, loading and interruptions (UX01–UX10).