Data release governance from proposal to proof

What happens before the release

The requester identifies the agreement, recipient, purpose, environment, transfer method, release date, retention period, authorized users, publication and redisclosure intent, DUO codes, and access end date. They attach the exact schema, payload, query manifest, or user list that will be reviewed.

Audarel hashes each artifact and inspects CSV structure without turning the raw release into an untracked copy. A changed artifact marks a completed result stale and creates a new revalidation path.

Deterministic release preflight

The decision engine evaluates only reviewer-confirmed controls and explicit institutional requirements. Each finding identifies the governing control, expected value, actual value, affected fields or rows, source citation, and severity.

A block means at least one release fact violates a confirmed constraint or required evidence is missing. A condition means the proposal needs a documented resolution or confirmation. An allow result is still subject to required attestations and human approval.

Approvals that reflect real authority

Approval workflows can be sequential and can require every approver, any member of a group, or a defined quorum. This supports manager, privacy, data owner, security, legal, and data access committee patterns without treating a single button click as universal authority.

Attestations preserve the exact statement, actor, and time. Approvers can approve or deny with comments, and the workflow prevents later tiers from deciding before prerequisite tiers are complete.

Exceptions are governed records

A condition or block should not disappear into a chat message. Audarel records the exception reason, remediation, owner, due date, status, decision note, deciding reviewer, and completion evidence. The original finding remains intact.

After approval

Approved releases can generate a versioned machine-readable policy bundle for downstream platforms. Connector bindings preserve desired and observed hashes, last check time, and drift status. Webhooks notify surrounding systems about decisions and state changes.

The final evidence pack is available as signed JSON and a human-readable PDF. It contains the agreement version, artifacts, controls, findings, release runs, attestations, approvals, exceptions, policy bundles, connectors, hashes, and decision-engine version.

Confirm requirements against current source material.

Requirements and vendor capabilities change. Confirm the current source and your approved QC plan before changing a production process.

• UK Data Service — Data access and sharing
• NIH Genomic Data Sharing Policy