Informational Fresh jira_story: GOV-144

Lesson 5 of 6 — Auditor read-only trail and export

Executive Command Centre · Source: Jira Story GOV-144 (5 pts) · Authority: Informational (the Jira story is authoritative).

Purpose

Give auditors an independent, read-only, verifiable trail.

Why it matters

Auditor independence requires zero write access and verifiable evidence.

Where this lives

Runs in the Customer AI Governance platform (components: command-centre). The auditor role is read-only (API 403 on writes) with sha256 verification and a regulator ZIP export. Learn teaches this read-only.

Workflow

Given an Auditor
When they open the Command Centre
Then they get zero writes (403), can verify sha256, and export a regulator ZIP

Worked example

An Auditor tries to change a finding's status. What does the platform return?

A 403 — auditors have zero write access; they verify and export, they don't edit.

Acceptance criteria (authoritative — GOV-144)

Given an Auditor, when they open the Command Centre, then they get zero writes (403), can verify sha256, and export a regulator ZIP.

Common pitfalls

Any write path leaking to the auditor role.

Knowledge check

Scenario: An Auditor tries to change a finding's status. What does the platform return?
Look for: A 403 — auditors have zero write access; they verify and export, they don't edit.

Key concepts

read-only auditor
sha256 verification
regulator export

For the AI Tutor

Summary: Give auditors an independent, read-only, verifiable trail.
When to use: teaching or answering questions about "auditor read-only trail and export".
When NOT to use: generating the board pack (that is GOV-145).
Key concepts: read-only auditor, sha256 verification, regulator export.

Completion criteria

Learner passes the scenario knowledge check and can point to the system state that satisfies GOV-144's acceptance criterion.

Module: LEARN-MOD-004 (Executive Command Centre)
Provenance: LEARN-MAP-001 · Generation standard: LEARN-STD-002
Next: LEARN-LSN-027