Workflow and evidence
Source references, declared policy, tenant, purpose, and intended destination.
AI Action Assurance / Reference Architecture
One governed action. Evidence through recovery.
DigiTrust connects the information reviewed, the human who approved it, the permitted action, and its recorded outcome.
This architecture explains the common control path behind the referral-intake and documentation-review references. Each example uses synthetic data and a simulated internal queue.
Synthetic reference workflowsIndependent human reviewAWS-first deployment profile
The shared control path
Separate the request, the approval, and the effect.
A model can help prepare an output. It cannot supply missing evidence, grant itself approval, or decide that an uncertain action should run again.
Approved model path
A bounded draft or summary, with the model and source context recorded.
Policy · Evidence · Independent approval
Verify the exact result, preserve gaps and corrections, and bind a separate authorized reviewer to a specific purpose, destination, and time window.
One permitted use
Revalidate approval and record the claim on the action before invoking the permitted effect.
Durable outcome record
Link the action, terminal observation, and delivery history so a lost response can be investigated.
Visible outcomesCompletedBlockedOutcome uncertain
Reference scope: The local execution adapter demonstrates a transactional internal queue and durable observation. Production adapters must prove their own transaction, authorization, revocation, and recovery behavior before activation.
Evidence and human control
Approval follows the exact evidence reviewed.
Make missing evidence visible
Checks use explicit policy and declared metadata: integrity, source authority and history, freshness, lifecycle, relevance, completeness, and independence.
Unresolved gaps, conflicting assertions, or a failed disclosure rule remain visible. Current checks do not infer truth from arbitrary prose.
Keep the reviewer accountable
The approval binds the result, evidence snapshot, role, purpose, destination, conditions, and expiration. The reviewer must be authorized and separate from the roles the policy excludes.
Changes create a new review requirement. A previous approval cannot silently transfer to a changed subject or destination.
Execution and recovery
A lost response is an unresolved outcome.
An action may have completed even when the caller did not receive its response. Recovery must inspect durable records and preserve uncertainty until the outcome is established.
The outcome is recorded
A matching durable observation identifies the completed action. Recover the receipt and continue delivery of its recorded event.
A required condition failed
Missing approval, changed scope, expired authority, or insufficient evidence prevents the action from proceeding.
Further inspection is required
A timeout or missing lookup does not authorize another attempt. Escalate unresolved cases and retain the original action identity.
The synthetic references exercise concurrent requests, replay rejection, lost responses, process restart, and receipt tampering. Whole-system restore, distributed revocation, recovery time, and recovery point objectives still require deployment-specific evidence.
Portability architecture
Keep the control contract consistent. Validate the environment.
A different AI model and a different hosting platform are separate changes. Both need review of the exact capabilities used by the workflow.
Which model may assist?
Identify the approved provider, model, location, guardrails, evidence mapping, and permissions. Model access alone does not approve a workflow.
Where do the controls operate?
Bind the application to its identity, storage, key custody, execution, event delivery, and recovery providers. Each adapter needs acceptance evidence.
What must remain true?
Preserve tenant scope, independent approval, exact permitted use, minimized evidence, and visible failure or uncertainty across every environment.
AWS is the first deployment profile. Additional clouds and self-hosted production environments remain architecture work until their adapters and operating controls pass acceptance.
Current stage / 14 September 2026
Reference evidence is available. Production acceptance remains open.
The merged source, installed runtime, and customer deployment are distinct evidence boundaries. Passing source tests or a synthetic simulation does not establish that a deployed workflow is ready for production.
| Area | Available evidence | Required before production use |
|---|---|---|
| Evidence and approval | Reference checks bind policy, sources, result, reviewer, and permitted use. | Accepted customer scope, roles, data access, and end-to-end identity and isolation checks. |
| Execution and recovery | A local transactional queue demonstrates one-time use, observation, and recovery from a lost response. | Accepted production effects, durable approval and delivery integration, revocation, and restore evidence. |
| Cryptographic protection | Authenticated reference history demonstrates context binding and tamper detection. | Reviewed protection providers, tenant key custody, durable trust anchors, retention, and deletion controls. |
| Deployment | An AWS runtime and deployment path exist. Reference source validation is separate. | Acceptance of the exact release, configuration, provider composition, monitoring, support, and recovery objectives. |
| Customer activation | Synthetic referral and documentation references support an architecture discussion. | Named owners, approved integrations, a customer data decision, and a recorded go/no-go decision. |
Customer responsibility: DigiTrust supports evidence and approval workflows. It does not replace clinical judgment, legal review, security programs, audits, certification, or regulatory obligations.
AWS deployment and purchasing
Start with the environment you can validate.
The AWS reference pattern provides the first implementation path. The deployment review binds its application image, provider configuration, identity, storage, key handling, and operational evidence.
AWS Marketplace provides a purchasing path for a scoped enterprise engagement. Marketplace availability and AWS solution review do not establish acceptance of every integration or customer workflow.
From reference to deployment
Choose the action, the owner, and the acceptance evidence.
Review a referral-intake or documentation workflow, confirm the boundaries, and define a production acceptance plan with DigiTrans.