Audit Evidence

Every runtime decision produces an evidence artifact with policy linkage and cryptographic integrity fields.

{
  "decision_id": "dec_123",
  "decision": "REQUIRE_APPROVAL",
  "policy_id": "HIPAA-EMAIL-001",
  "approval_status": "PENDING",
  "signature": "ed25519:...",
  "evidence_hash": "sha256:...",
  "compliance_mapping": ["HIPAA 164.312(b)"],
  "correlation_id": "corr_456"
}