The sign-off

01From review work to a verifiable attestation #sec_8d4f2185

In an access review, completing a list of decisions is not enough. It must be possible to establish, later, which scope was examined, according to which policy, by whom, with which decisions and under which conditions. The sign-off is the function that transforms completed review work into a durable attestation.

Decisions belong to the campaign process; the attestation belongs to the proof registry. It does not replace the reviewer's judgment and does not correct it. It freezes the result, context and provenance in a form that can be verified without reinterpreting the current state of the system.

The evidential unit is not the decision: it is the scope. REVIEWIT reasons by review batch — the part entrusted to a reviewer for a given campaign. The attestation seals the complete scope of the batch at the same time as the decisions made, which closes the most difficult audit dispute to refute: “I never saw that element”.

02Two acts not to be confused #sec_5d9170c3

A campaign ends because a deadline arrives: it is a temporal fact, and the system notes it alone. Someone pronounces on what has been reviewed: it is a formal act, and it belongs to a person.

REVIEWIT strictly separates the two, and the consequence is explicit: the system never signs. No expiration, no background pass, no closure rule produces a signature on behalf of anyone.

What an automatic closure produces, when the campaign has provided for it, are decisions of origin “rule” — identified as such, with the rule applied and its non-human origin. They enter the attestation like the others, but they never disguise themselves as a human judgment.

This separation has a cost, and it is assumed: a campaign can end without anyone having signed. The product prefers to display it — an honest quantified coverage, including the number of unattested batches — rather than to enter an attestation that no one assumes.

03You do not sign what can still be contested #sec_4647db05

A review decision can be contested by the person it affects, during a window opened after the decision. Signing before the end of this window would amount to sealing a result that a receivable contestation can still change.

The campaign sign-off therefore waits for the end of the contestation period, calculated in working days from the campaign rules. The window is displayed: the product says until when you must wait, rather than refusing without reason.

One exception, and only one: if the campaign has produced nothing contestable, there is nothing to wait for.

Conversely, a contestation received after a sealing does not rewrite anything. It produces new work, therefore new decisions, therefore one more attestation — which the next rank will aggregate.

04What is frozen at the time of sign-off #sec_6d93f41e

The sign-off takes a sealing snapshot. From this moment, the construction of the proof no longer reads the living directories: it works exclusively with the frozen elements.

The snapshot notably includes :

• the exact scope of the batch and the fingerprint of the reference collection;
• the decisions, their origin — human or born of a rule — and the default rules actually applied;
• the version of the policy frozen at the arming of the campaign, with its criteria;
• the identity of the decider and, when distinct, that of the person who signed;
• the closure mode retained by the campaign;
• the format versions necessary for future verification.

This photograph protects the proof against subsequent changes. A user can be renamed, a policy replaced, a directory updated: the attestation continues to tell what was true at the time of closure.

Two categories are treated explicitly rather than passed over in silence. An undecided element is counted and declared; it is not hashed like a decision that does not exist. An element removed from the scope — canceled, or expired pending — does not count in the progress, nor in the eligibility, nor in the attested scope; it remains listed.

The batch then goes through an explicit sealing state: it is frozen, no decision can be modified and no element can be added. This state is never presented as a completed attestation. Either the construction is completed, or it resumes deterministically from the same snapshot — a resumption gives exactly the same proof.

05A proof of integrity without disclosing the entire batch #sec_ad54210d

The attestation separately engages two sets: the examined scope and the decisions made. REVIEWIT represents them in the form of integrity trees. Their root acts as a compact fingerprint: modifying an element, removing one or changing a decision produces a different root.

This mechanism allows targeted verification. An auditor can receive proof that a specific element belonged to the batch and carried a given decision, without the entire content of the campaign being disclosed. The secrets that make this proof possible are provided by SEAL and are never exposed.

06From the batch to the campaign: noting the coverage #sec_5f556982

Each reviewer attests his share. The question remained above: do these shares cover the scope of the campaign?

This is the purpose of the campaign's probative closure. It aggregates existing attestations, and — for elements that no attestation covers — the current decision, hashed exactly like the others. It records figures: number of batches, number of attestations, number of unattested batches.

It notes the coverage, it does not require it. A refusal to close until everything is attested would never say anything about a real campaign; an honest figure, yes. The only refusal is the empty case: a campaign of which nothing has been attested and of which no decision exists has nothing to seal.

A fundamental rule, on the other hand, is not negotiable: you do not close a scope that is still moving. A targeted wave must be completed; an entire campaign requires that all its waves be completed.

07Correct without rewriting: the rank #sec_d12e5b19

A sealed proof is not corrected. It is completed.

When attestations arrive after a closure — a treated contestation, a late reviewer —, REVIEWIT does not touch the existing rank: it pronounces a new one, on the same scope. Ranks are counted by scope: an entire campaign and each of its waves have their own sequence.

A higher rank carries, sealed in its manifest, the reason for its existence and the imprint of the rank that precedes it. The chain is therefore readable from end to end: each rank says where it comes from and why it was pronounced. The previous rank remains intact, verifiable, and opposable.

08Anchoring, then sealing #sec_25ee923a

The integrity of an attestation is demonstrated in two steps, and the two proofs are composed.

Anchoring inscribes the imprint of the attestation in the audit trail, whose chain is itself unfalsifiable. The invariant is simple: no observable attestation can exist without proof anchoring.

The seal is issued by an authority external to the product, on a separate account. What the authority attests is precise, and it must be stated as such: rank R of segment S was covered by a seal that it issued. It does not attest that such an imprint occupies this rank — this second link is demonstrated on the chain, at the client's. Two independent proofs, which do not fall together.

Practical consequence, and it counts: a package is only declared sealed if it can cite its seal . As long as the seal is not there, it is said to be anchored — never optimistically sealed.

09What the auditor receives #sec_5d0c3d07

The exploitable result is not a "completed" status. It is a coherent verification package: the frozen manifest, the integrity roots, the necessary leaves or paths, the anchoring state and the citation of the seal.

Three forms exist, depending on the question asked: the complete package of an attestation, the punctual proof of a single element, and the package of a campaign closure.

This package is verified offline, by a pure function, without asking REVIEWIT for anything — it is the property that makes it valuable. An independent verification tool is published with its format; a third party can reimplement the control from the specification alone.

A readable document accompanies the attestation. It is a restitution of the sealed manifest, composed only once, with its own imprint: it is never the source of truth, and any delivery serves the same copy.

The reader can thus answer four questions :

1. is this scope the one that was entrusted to the reviewer?
2. are the decisions presented those that were sealed?
3. who decided, and who signed?
4. under what policy, at what rank, and according to what mode did the closure take place?

The conservation of the package follows that of the attestation. A proof must not survive what allows it to be interpreted, and a secret necessary for future verification must not disappear before it.

10What the sign-off does not do #sec_7f00df1c

It does not correct any decision . It states what has been decided, including what has been decided by a rule.

It does not change any campaign, batch or request status. The process belongs to the pipeline; the sign-off produces a proof alongside, with its ranks and seal states.

It does not execute anything . The boundary is clear and it is structuring for remediation: the seal certifies the decision, not its execution. Whether an access has been revoked in the original system is another proof, and is demonstrated elsewhere.

It does not replace the audit trail. It anchors itself to it.

11In summary #sec_1d07a18e

The sign-off is the boundary between conducting a review and being able to demonstrate what has been reviewed.

It freezes the context, separates the temporal act from the formal act, never attributes a signature to a machine, waits for the contestation to be closed, makes the retakes deterministic, completes with ranks instead of rewriting — and produces an attestation whose integrity can be exercised by a third party, not just affirmed.