Skip to content

Policy Attestations

Path: /policy-attestations

Attestation campaigns close the loop between publishing a policy and proving that people actually acknowledged it — the record auditors ask for when they see "Acceptable Use Policy, v3, active."

How it works

A campaign assigns one or more policies to a set of users and/or roles with an optional due date. Each assignee attests to each policy; the attestation pins:

  • Who — the authenticated caller (you can only attest for yourself),
  • When — the timestamp,
  • Which version — the policy's version string, its content SHA-256, and a link to the immutable version snapshot that was current at attestation time.

Every attestation is also written to the tamper-evident audit trail as a signed ATTEST entry, so the acknowledgment is cryptographically attributable and cannot be silently edited later.

Enforcement rules

  • Only assigned users (directly or via role) can attest — others get 403.
  • A user can attest each policy in a campaign once (409 on repeats).
  • Closed campaigns reject new attestations.
  • Campaign creation requires a manager/admin role; campaigns are org-scoped.

Completion reporting

The campaign report computes completion as a percentage across current assignees × policies, with per-policy and per-user breakdowns. Attestations from users who are no longer assignees are never counted toward completion — the number reflects reality, not history.

API

POST   /api/v1/orgs/{org_id}/attestation-campaigns                      # create campaign
GET    /api/v1/orgs/{org_id}/attestation-campaigns                      # list
GET    /api/v1/orgs/{org_id}/attestation-campaigns/{id}                 # detail
POST   /api/v1/orgs/{org_id}/attestation-campaigns/{id}/close           # close
POST   /api/v1/orgs/{org_id}/attestation-campaigns/{id}/attest          # attest (caller only)
GET    /api/v1/orgs/{org_id}/attestation-campaigns/{id}/attestations    # list attestations
GET    /api/v1/orgs/{org_id}/attestation-campaigns/{id}/report          # completion report

Using the page

  1. Click New Campaign, pick the policies, assign users and/or roles, and set a due date.
  2. Assignees see their pending attestations on the same page and attest with one click per policy.
  3. Track the completion percentage and per-user progress; Close the campaign when done.