Skip to main content

Sealed decisions

Included with: Professional and Enterprise.

Normally, "Jane approved this" is a row in a database, and the only evidence is that we say so. A seal replaces that with a signature only Jane could produce.

User guide​

Adding a passkey​

Settings → Sealing decisions → Add a passkey. You use the same face, fingerprint or PIN that unlocks your device. Nothing secret leaves it — we store only a public key.

Sealing a decision​

Open the decision and choose Seal this decision. You are shown the exact text you are about to sign, then confirm with your device.

What it means​

Your signature covers the words of the decision, not just the fact that you logged in. If anyone edits the wording afterwards, the seal no longer matches and anyone checking can see that.

If the wording changes later​

The earlier seal stays valid over the earlier words. The decision shows that it was edited since sealing, and offers the exact text that was signed. Minutes get corrected legitimately — this is not an accusation, it is a fact the board should see.

If you lose your phone​

Remove the passkey in Settings and add one from your new device. Decisions you already sealed remain valid and verifiable — a seal made while the device was yours does not stop being true.

Technical notes​

  • Feature key: sealed_decisions — gated at /api/seals
  • WebAuthn. The SHA-256 of the canonical decision text is bound into the challenge, so the assertion attests to the document rather than to a session
  • verifySeal re-derives the hash rather than trusting the challenge, and refuses if the decision changed mid-signature
  • decision_seal is append-only: UPDATE is refused unconditionally, DELETE only under a declared board purge
  • Credentials are revoked, never deleted, so historical seals stay verifiable

Support notes​

"It says my passkey is not enrolled"​

Usually: enrolled on a different device, or removed. Check: Settings → Sealing decisions.

"This decision changed while you were signing it"​

Exactly what it says — the wording was edited between starting and confirming. Nothing was sealed. Review the new wording and seal again.

"A seal shows as no longer matching"​

The decision was edited after it was sealed. Open "see what was signed" to compare. If the change was legitimate, ask directors to re-seal.

Known limitations​

Passkeys are per-device unless your platform syncs them. Sealing needs a device with a screen lock.