METHODS AND SYSTEMS FOR CREATING VERIFIABLE EVIDENCE RECORDS FOR ACCESS CONTROL DECISION-BASED ON RISK AND RECORDS

Abstract

The invention proposes a decision control layer that enforces decision-making responsibility in a multi-subscriber system. The system receives access requests, identifies the subscriber and the subject making the request, maps the operation to a tier, and evaluates contextual risk signals to make access control decisions (allow / require enhanced authentication / deny). For high-tier or high-risk operations, the system forces a step-up using strong authentication (Passkey / WebAuthn or time-based authentication code). Simultaneously, the system generates a structured evidence record containing at least: tenant_id, subject_id_hash (a hash without explicit personal data), timing, tier / risk, policy decision, and payload_hash of the result within a fixed hash range after canonicalization. The system generates an idempotency_key to prevent duplication due to retry / replay and applies fail-closed at the synchronization / encapsulation edge to prevent the issuance of invalid evidence.In audit mode, records are packaged into an audit pack (manifest + root hash + offline verifier) ​​for independent verification.