# Audit bundle

> The signed body of an approval's audit bundle: what a signed-export.schema.json envelope of kind audit-bundle carries in bundle (decoded).

`@kindgi/specs/audit-bundle.schema.json`, schema version 2.0.0.

The signed body of an approval's audit bundle: what a `signed-export.schema.json` envelope of kind `audit-bundle` carries in `bundle` (decoded). Who decided a human review, when, why, and the evidence, signed by the deployment. 2.0.0: this describes the bundle the API exports (one approval, a detached signature over these bytes); 1.0.0 described a multi-approval format with an inline signature that the runtime never produced.

- `bundleSchemaVersion` (`"2.0.0"`, required)

- `approvalId` (string, required)

- `tenantId` (string, required)

- `subjectKind` (string, required): What the review was of: `tool-call:pending`, a session gate, a deployment…

- `subjectRef` (object, required): The reviewed thing's own reference, by subject kind.

- `requiredRole` (`"standard"` | `"senior"` | `"admin"`, required)

- `status` (`"approved"` | `"rejected"` | `"escalated"` | `"expired"` | `"withdrawn"`, required): Only a decided approval is exported.

- `createdAt` (string (date-time), required)

- `decidedAt` (string (date-time))

- `decision` (one of the objects below, required): The recorded decision; `null` when the approval ended without one (expired).

  - null

  - an object

    - `kind` (string, required): `approve`, `reject`, `escalate` or `withdraw`.
    - `reviewerId` (string, required)
    - `reviewerRoleAtDecision` (`"standard"` | `"senior"` | `"admin"`, required)
    - `decidedAt` (string (date-time), required)
    - `rationale` (string)

- `evidence` (object, required)

  - `guardrailResults` (array of any): The guardrail results that raised the review, when it came from one.
  - `messages` (array of any): The conversation messages of the approval's run, when asked for (`includeMessages`).

- `exportedAt` (string (date-time), required)