Overview
Stateway provides a complete, tamper-evident audit trail for every process execution. Every definition version, every gateway decision, every timer fire, and every decision rule evaluation is recorded and cryptographically linked.
Hash Verification
Every definition version stores a SHA-256 hash of its source content (source_hash). This hash lets you prove — without privileged database access — that a specific file is byte-for-byte identical to what Stateway stored and executed.
Audit Log
Stateway maintains a unified audit log that records both API-level and engine-level events in a single sequence. Every action — from creating a process instance to the engine resolving a gateway — appears in this log.
Chain Integrity
Stateway's audit log is tamper-evident. Each entry includes a cryptographic hash (entryHash) computed over the entry's own content plus the hash of the immediately preceding entry (prevEntryHash). This creates an unbroken chain: deleting, inserting, or modifying any entry in the middle produces a detectable mismatch.
Decision Trail
Every DMN decision evaluation — whether triggered directly via the API or by a businessRuleTask inside a running process — is automatically persisted. The record captures the exact inputs, which rules matched, and the outputs produced.