Trust Layer

Trust Layer

Cross-cutting structures that wrap every object in the layers below with auditability, provenance, and consent. These are what make a SIGNET network's history a tamper-evident system of record rather than a mutable database.

Object	Purpose	Aligns to
Event	An append-only, hash-chained record of a material change.	event-sourcing
Provenance	Who/what produced an assertion, when, from what.	W3C PROV-O
Consent	A data-sovereignty access grant.	Solid consent pattern

---

Event

An append-only record of a material change. The current state of any object is the projection of its ordered Event stream (design principle 1.7). This makes audit native and tampering evident.

Field	Type	Card.	Definition
id	Identifier	1	Event identifier.
eventType	string	1	See eventType codelist, e.g. submission.lodged, award.decided, mandate.granted.
subject	Identifier	1	The object the event concerns.
actor	Identifier	1	The Party (human or synthetic) that caused the event.
timestamp	date-time	1	When it occurred.
payload	object	0..1	The change.
previousEventHash	string	0..1	Hash of the prior event, forming a tamper-evident chain.
provenance	Provenance	1	Provenance.

previousEventHash chains each event to its predecessor: altering any historical event breaks the chain and is therefore detectable. Replaying the ordered stream reconstructs the current state of any object.

---

Provenance

Who or what produced an assertion, when, and from what. Aligned to W3C PROV. Also defined in the Foundation Layer because it is embedded in Decisions and Events.

Field	Type	Card.	Definition
generatedBy	Identifier	1	The agent or activity that produced the assertion.
generatedAt	date-time	1	When.
derivedFrom	Identifier[]	0..*	Source objects.
usedPolicies	Identifier[]	0..*	Policies applied.
signature	object	0..1	Cryptographic signature over the assertion.

In the JSON-LD context, generatedBy maps to prov:wasGeneratedBy and derivedFrom to prov:wasDerivedFrom, so SIGNET provenance is interpretable by any PROV toolchain.

---

Consent

A data-sovereignty access grant — the right of a named party, for a stated purpose, for a bounded time, to access data held by another party. Expresses the Solid consent pattern as CDM data (design principle 1.5).

Field	Type	Card.	Definition
id	Identifier	1	Consent identifier.
grantor	Identifier	1	The party who owns the data.
grantee	Identifier	1	The party granted access.
resource	Identifier[]	1..*	The data resources covered.
purpose	string	1	The permitted purpose.
validity	Period	1	Time bound.
revocable	boolean	1	Whether revocable before expiry.
proof	object	0..1	Signed grant.

A Document whose access is controlled references a Consent object via its accessGrant field. This is how the model separates an assertion from the right to access the data behind it — the CDM never assumes a central data warehouse.

Putting it together

A typical award flow generates, across the layers:

1. A need.raised Event when a Need is created.
2. A sourcingEvent.published Event for the SourcingEvent.
3. A submission.lodged Event per Submission.
4. An evaluation.completed Event, with the Evaluation linking to a Decision that embeds Provenance.
5. An award.decided Event for the Award, again backed by a signed Decision.
6. A contract.signed Event for the Contract.
7. An obligation.discharged Event when an Obligation flips to met — the Invoice that settles it is recorded via settles, and the obligation back-references it via dischargedBy. This is the step that closes the loop: the commitment made at contract.signed is now discharged, traversably, as data.

Each event is hash-chained to the last; each decision is signed; each policy applied is referenced. The audit trail is the system of record.

Where to go next

• Agent Layer — the Decisions and Policies that Events reference.
• Serialisation (JSON-LD) — how provenance maps to W3C PROV terms.
• Codelists → eventType.