The config changed on Saturday. Which data did it change?
A service account reduces batch size and Monday throughput collapses. The audit question is not only who changed the file. It is which exact outputs were produced under that configuration.
Model configuration as transformation evidence
- Bind the config bytes Record the exact configuration artifact or digest used by the operation.
- Name the executor Sign the transformation with the workload identity and let receiver policy decide whether that identity was authorized.
- Append affected outputs Each output statement references the input data, predecessor statement, operation, and configuration evidence.
- Traverse the interval Postmortem analysis can identify outputs produced after the changed config and before the corrected one.
What remains outside Makoto
Change approval, human intent, alerting, and root-cause judgment remain separate systems. Makoto supplies attributable, tamper-evident claims about artifacts; it does not decide whether the configuration was wise.
Concrete postmortem record
| Before | Configuration artifact A is bound to outputs produced under the earlier settings. |
|---|---|
| Change | Configuration artifact B is committed; the next transformation statement names its digest and authorized workload signer. |
| Blast radius | Traverse descendants produced after B and before corrective artifact C. |
| Finding | The report identifies attributable claims and affected bytes without pretending to know whether the human change was justified. |
Configuration belongs in the evidence as an exact input artifact, not merely a free-text note or ticket URL.