# Compliance evidence bundle

> One evidence record emitted by the Kindgi runtime for compliance / audit consumption.

`@kindgi/specs/compliance-evidence.schema.json`, schema version 1.1.0.

One evidence record emitted by the Kindgi runtime for compliance / audit consumption. Derived from provenance DAG + policy decisions + audit log. Consumed by a ComplianceProvider, whose adapters forward evidence to a compliance platform or a SIEM. The optional Ed25519 `signature` provides tamper detection.

- `id` (string, required): Unique evidence record ID.

- `tenantId` (string, required)

- `projectId` (string): Content-scope anchor: the project the underlying audit event belongs to. Absent for tenant-level events (e.g. authz decisions, tenant-level admin actions).

- `kind` (string, required): The compliance-relevant event class. Open set: evidence is a classifier lens over the audit stream, and a deployment can mark any audit-event kind exportable. `examples` lists the built-in kinds; consumers must tolerate kinds they do not know.

- `timestamp` (string (date-time), required)

- `actor` (object): Who performed the action.

  - `kind` (`"user"` | `"agent"` | `"system"` | `"admin"` | `"external"`)
  - `id` (string)
  - `ipAddress` (string)
  - `userAgent` (string)

- `subject` (object): What the action was performed on.

  - `kind` (string)
  - `id` (string)

- `outcome` (`"allowed"` | `"denied"` | `"succeeded"` | `"failed"` | `"escalated"`): Result of the action, for kinds where this is meaningful.

- `payload` (map of any, required): Kind-specific evidence detail. For policy-decision: the rule that matched, the request context. For config-change: before/after diff. For secret-rotation: which secret, when. Etc.

- `provenanceRef` (object): Optional back-reference to the provenance DAG that produced this evidence.

  - `runId` (string)
  - `nodeId` (string)

- `signature` (object)

  - `algorithm` (`"ed25519"`, required)
  - `keyId` (string, required)
  - `value` (string, required)
  - `signedAt` (string (date-time), required)