Platform
Sealed in your tenant, verifiable offline. The four surfaces in full, the departed-approver case, and the four separate verification results with their exit codes.
Four surfaces
Declared authority remains the standard. Evidence sources report what they saw; Cerydora reconciles those facts and routes consequential judgment to accountable people.
Shows what each governed service account, workload identity, bot, or AI agent was authorized to do versus what it was observed doing—across on-prem Active Directory, Entra ID, and supported activity sources.
Surfaces dormant, ownerless, over-privileged, and revalidation-required states where the evidence supports them.An open, signed evidence package with declared authority, evaluated conditions, source references, integrity material, and explicit coverage limits—the artifact an examiner receives.
Checks format conformance, payload integrity, signature validity, and issuer trust as four separate results, without contacting the engine or a network service.
These checks cover the package. Source truth and legal sufficiency require separate review.Ties each authorization to an immutable directory identity instead of a reusable username, then records when that approving principal is disabled or deleted.
What the record shows
Every evaluated condition lands in a closed disposition, with the evidence and timing behind it. The outward package can be curated without exposing internal working state.
Honesty rule: no evidence is not evidence of conformance. If an instrument stops reporting or evidence becomes stale, the record says so.
Agent operations / departed approver
Internal operator view, as rendered for the synthetic corpus. The examiner projection withholds these determinations and says so. Names, identifiers, and evidence are fictional.
$ cerydora-verify trescott-agents.bundle --offline
Four separate results; no aggregate “verified” verdict. The demonstration bundle is signed by a self-presented identity. Your agency's issuer is enrolled at onboarding, after which this result reads ESTABLISHED.
cerydora-verify <bundle> · no network.
Exit 0: format PASS, integrity PASS, signature VALID, issuer trust not MISMATCH. Issuer trust may still be NOT ESTABLISHED. Exit 1: verification failed. Exit 2: unreadable or structurally nonconforming input.
Crosswalk by reference
Framework identifiers travel with the authority record. Cerydora reproduces no control text, claims no certification, and does not decide whether a control is met.