Machine-verifiable evidence for human-approval decisions, an open format offered for the KSI process

[FutureEnterprises]

I run EMILIA Protocol, a small open project (Apache 2.0) that works on one narrow piece of the evidence problem: proving a named human approved a specific consequential action, in a form a third party can verify by machine.

I have read a lot of compliance modernization plans. 20x is the first one that treats evidence as something to verify rather than something to file, and the Automatic Validation principle is the part I keep coming back to.

It also exposes a hard case. Any indicator that turns on a human decision (change approval, access grants, break-glass, production deployments) is usually evidenced by a ticket screenshot or a log line the provider maintains. So the validation pipeline ends up trusting the provider's own records for the one control class where those records are the thing in question.

The format we build closes that gap. The approver signs the exact action (Ed25519 over RFC 8785 canonical JSON), the receipt binds the named approver to that action's digest, and anyone can verify it offline with a CLI against keys the relying party pins. No call back to us, and no vendor in the trust path. Our standard demo walks a two-person approval on a high-value disbursement, then jumps six months ahead to an audit where the issuing service no longer exists, and the auditor still verifies the authorization from a single file while a forged copy is refused with a stated reason. Honestly, the offline audit moment is pretty cool to watch.

The pieces are public. The specification is posted as individual Internet-Drafts at the IETF (draft-schrock-ep-authorization-receipts, an individual submission, not an adopted standard). The verifier and an 18-suite conformance corpus are in the open repo, and everything is Apache 2.0, so an agency or assessor can adopt it, fork it, or replace it without touching us.

My question for the working group: as Phase 3 formalizes requirements, does human-approval evidence belong inside KSI validation, or is that class of evidence out of scope for 20x as designed? If it belongs, I would like to contribute the format into the open process, and I am glad to bring the runnable demo to a community call. You all see the whole assessment picture in a way I do not.

Iman Schrock, EMILIA Protocol
emiliaprotocol.ai | github.com/emiliaprotocol/emilia-protocol