The record¶
A decision in Attest is more than a status. It is a record with enough in it to stand on its own when someone asks about it later.
What a decision contains¶
| Field | What it is |
|---|---|
| Container and version | What was decided. |
| Pipeline id | The run the decision was made on. |
| Evidence hash | The commit in the security repository where the scan record for that run lives. |
| Policy version | The gate policy in force when the verdict was computed. |
| Per finding decisions | For each soft finding: accepted or rejected, the written basis, and the time. |
| Authorization | Approve or reject, the reviewer's GitLab identity, the time, and the merge request. |
Every one of these points to something in GitLab you can open and check for yourself.
Where it is kept¶
The review merge request in the security repository is the durable record. The pipeline opens it, the reviewer approves or closes it under their own account, and any rejection reason is posted as a note on it. The merge request description carries the CVE table with every justification, and the branch points at the scan directory at its commit. GitLab keeps all of this for as long as the project exists.
Attest also keeps a decision log that mirrors the per finding decisions and the authorization and points back at the merge request. Every cache Attest holds can be rebuilt from GitLab, and if the two ever disagree, GitLab is the source of truth.
Justifications on the record¶
The developer's justification lives in their repository, in cdso_config.yml, at the commit that was built. The pipeline copies it word for word into the scan record, and the merge request description carries it again. The reviewer's basis, written in response to it, is on the merge request. The two sit side by side, and neither can be changed afterwards without leaving a trace in Git.
Who can see what¶
| Role | Sees |
|---|---|
| Viewer | Security posture, every application, every evidence view, every decision. Read only. |
| Reviewer | The same, plus the queue and the decision controls. |
| Engineer | Their own applications and the reviewer's feedback, word for word. |
| Administrator | Everything, plus system health, the audit view of all decisions and claims, and the ability to release a stuck claim with a visible note. |
An administrator cannot approve on anyone's behalf. Authorization cannot be delegated.
Explainable AI and the record¶
The narration Explainable AI writes to help a reviewer read the evidence is not part of the record. It is not stored as a decision, it is not signed, and it carries no weight in an audit. The record is the reviewer's basis, the reviewer's identity, and the evidence hash.