Step 1 · Sponsor
Sponsor Request
Sponsor Portal (L5)
~2 min
Sponsor submits a protocol amendment request via the sponsor portal. The request includes the rationale, the affected sections, and target studies. No regulated record is written yet — only an intent row.
Evidence trail
- Sponsor identity attested via Supabase Auth + MFA
- Request row in sponsor_request table (intent only)
- created_at, created_by populated by RLS policy
Step 2 · System
Staging Record
Staging tables (L1)
~30 sec
The orchestrator writes a structured staging_record bound to the sponsor request. All downstream agent work targets this staging row — never live tables. This satisfies the architectural invariant that agents write only to staging.
Evidence trail
- staging_record row with provenance_id
- Transactional outbox entry in cro.app_log
- Governor policy check passes (no live write)
Step 3 · Agent
Agent Classification
Knowledge RAG Agent (L3)
~3 minA2
The Knowledge RAG agent classifies the amendment (substantial vs. non-substantial, ICH E6(R3) categories) and tags the affected sections. All claims are citation-grounded against ICH/FDA guidance.
Evidence trail
- Agent run row with prompt + model registry version
- Citation manifest in packages/citations format
- Token + cost telemetry to cost_event
Step 4 · Agent
Agent Validation
Evaluation Agent (L3)
~5 minA2
The Evaluation agent cross-checks the classification against the protocol, prior amendments, and applicable LCD/NCD coverage. It produces a risk score and a list of unresolved questions for human review.
Evidence trail
- Evaluation report attached to staging_record
- Risk score + rationale persisted to risk_register
- No causality call — architecturally blocked for safety claims
Step 5 · Human
E-Sign Gate
E-Signature Service (L4)
~4 min
A signed human reviewer re-authenticates, states intent, and signs. The signature row is immutable and binds the staging_record to a signer identity. This is the only path through which staging becomes live.
Evidence trail
- Part 11 signature row (re-auth, intent, timestamp)
- TOTP MFA challenge attested
- Signature linked to staging_record by foreign key
Step 6 · System
Live Promotion
Orchestrator (L2)
~10 sec
On valid signature, the orchestrator promotes staging→live atomically. Live writes carry the signature_id so any inspector can trace the live row back to the human who signed.
Evidence trail
- Live row written with signature_id foreign key
- staging_record marked as promoted
- Database webhook fires to notifier service
Every step above has already written provenance_event rows. The audit trail agent compiles them into a chronological ALCOA+ narrative, ready for export. Nothing is reconstructed — only assembled.
Evidence trail
- Chronological provenance_event sequence
- ALCOA+ checks: Attributable, Legible, Contemporaneous, Original, Accurate
- Audit bundle hash recorded for tamper-evidence
Step 8 · Human
Inspection View
Inspector Console (L5)
~variable
An FDA/EMA inspector (or internal QA) opens the inspection package. They see the full chain: sponsor request, staging, agent rationale + citations, signature, live row, audit narrative. Read-only, single-pane-of-glass.
Evidence trail
- Inspection package generated on demand (read-only)
- Every artifact linked to its provenance_id
- Export to PDF/ZIP via /exports