GATE 1 · IDENTITY
IAL2 assertion check
Before approval routing, the requester's CSP assertion is re-validated: IAL2 proofing, AAL2 session, signed FAL2 assertion. Failures route to Tickets automatically.
GATE 2 · APPROVAL
Delegated authority check
The assigned approver's warrant is checked against the PO amount. Orders above $500k require an AAL3 step-up (PIV) before funding certification.
AUDIT BINDING
Every transition logged
Each stage transition writes a signed audit record — actor, assertion, policy, and decision — visible in Audit Logs within seconds.