{ "audit_id": "e5d3c9b2-7a4f-4d1a-9c6b-1f9e5b7a9d3c", "entries": [ {"timestamp":"2026-04-13T14:12:01Z","user":"MaraLeclerc","action":"download","status":"success"}, {"timestamp":"2026-04-13T14:14:22Z","user":"MaraLeclerc","action":"decrypt","status":"denied","reason":"policy_001"} ] } The system had her attempt to decrypt the GOV‑FR‑CNC entry because policy 001 required a real‑time biometric verification that she had not performed. The system logged the denial, and the attempt was visible to the authority.
The JWT read:
Mara’s client verified the signature against the known and confirmed the hash. The PDF now contained more than text —it held an encrypted payload : a PKCS#7 envelope wrapping a JWT (JSON Web Token) that described the next step.
During the handshake, the server presented a : a nonce encrypted with a public key that only the client possessed (derived from the earlier JWT). The client decrypted the nonce, signed it with its private attestation key , and sent it back.