What a replay pack actually contains.

One decision, replayed in full. A supplier exception approved in August and questioned by internal audit six months later: what was known at the time, who had the authority, what conditions were attached, and what has changed since. Illustrative example, not a customer record.

Check one of your own decisions → Book the Diagnostic

Read this first

Every section below is marked EXAMPLE. The organisation, the supplier, the people and the dates are invented. No customer record is reproduced here, in whole or in part.
It shows the structure of a replay pack against a decision of a kind that is common. It is not evidence that any particular organisation has one, and it is not a case study.
Replayability is a property of the record, not a legal conclusion. No claim of legal sufficiency is made, and audit-ready is not promised — acceptance is your auditor's.
The product views are drawn, not captured. They show this example's own record in the real layout, rather than a screenshot of somebody else's data.
The gaps shown are deliberate. A real pack has them too, and a sample that showed a complete record would misrepresent what the first replay usually finds.

1 · The decisionExample

DECISION TR-2026-0418 · DECISION IN FORCE

Supplier exception — what was known, who approved it, what conditions applied

Organisation: a general insurer, approximately 600 staff (constructed)
Decision class: material service-provider exception
Approved: 14 August 2026, 16:22
Review due: 14 February 2027
Why it was replayed: internal audit asked how the exception was justified

Binding issued a Decision Authority Record — what was approved, by whom, on what basis, for how long and under which conditions, bound to the approved payload hash. Everything below is read from it rather than reassembled afterwards.

2 · The evidence snapshot, as it stoodExample

Four evidence items, frozen at evaluation with provenance, timestamps, trust class and freshness. Corrections are append-only and never overwrite the snapshot.

SOC 2 report — the supplier's, current at the decision and preserved as it was then, not as it reads now.
Data protection impact assessment — version 3, the version actually relied on.
Policy version in force — pinned at evaluation, so the rule the decision was made under is the rule it is replayed against.
Committee minute — recording the approval and the two conditions attached to it.
Referred to and never located — an “updated remediation plan from the supplier”, named in the minute. Two people recall seeing it. It is in no system, and the supplier contact who sent it has since left. It is not in the snapshot, and nothing infers it into one.

The Requirement Status view for decision TR-2026-0418: six rows, each a requirement with a status and a reason. The SOC 2 report, the data protection impact assessment, the policy version in force and the committee minute are all Met. The supplier remediation plan is Missing, named in the minute but not located, and the quarterly supplier update is Missing, one received and none since. — **Requirement status** — evidence, attestations, approvals and control assurance shown as met or missing, with the gap named rather than filled.

3 · Challenge, authority and conditionsExample

11 Aug, 10:05 — challenge and revision. Security review added two compensating controls. Both recorded, and the revision is part of the record rather than a replacement of it.
14 Aug, 16:22 — authority. Approved by the Chief Information Security Officer and the Head of Procurement, jointly. Both within delegation, and the delegation version in force is preserved.
Stated rationale: replacement was scheduled for the following financial year; migrating early would have moved a claims-processing dependency during peak season.
Alternatives considered: two, both recorded — accelerate migration, or accept with compensating controls. The second was chosen.
Condition 1, open: the two compensating controls remain in place for the life of the exception.
Condition 2, open: the supplier provides a remediation plan and a quarterly update. One update received; none since.
Verbal and unconfirmable: the minute notes that the Chief Risk Officer “indicated support”. There is no record of what was seen or said, and it cannot now be reconstructed.

4 · Drift — what has changed sinceExample

Review due 14 February 2027. Nothing has changed that unsettles the approval.

Revocation triggers were re-tested against refreshed evidence. None fired.
The replacement programme remains on the schedule the rationale assumed.
Both compensating controls are still in place, and are still the controls that were approved.
Freshness has moved. The SOC 2 report is older than it was; it has not passed the threshold that would unsettle the decision, and the replay says which it is rather than leaving it to be inferred.

Drift is reported as structure, not prose. If a revocation trigger had fired, withdrawal would move this decision to No Longer in Force without altering a byte of its history.

The State Replay view for decision TR-2026-0418: four states across twelve events, first Draft or Requested and currently Decision in Force. The timeline runs from evidence preserved on 4 August, through a security challenge that added two compensating controls on 11 August, to approval by the CISO and Head of Procurement on 14 August, and a drift view today showing review due 14 February 2027 with nothing that unsettles the approval. — **State replay** — the whole decision in order: a chronological narrative of real events, with lifecycle states inferred only where the timeline supports them.

5 · The gaps, in the same view

What a reviewer would ask that this record cannot answer

Marked EXAMPLE

The missing remediation plan. Relied on in the minute, absent from every system. This is the single weakest point in the record, and the replay names it rather than filling it.
The CRO's position. Recorded as support, with nothing behind it. Either it mattered to the decision or it should not have been minuted.
Condition 2 has produced one update and no more. Nobody was assigned to receive the quarterly update, so its absence generated no signal until the replay asked.
Eight days between the decision and the record. Enough for detail to be reconstructed rather than captured, which is what a reviewer discounts.

Four findings, three of them fixable this week — on a decision that is still sound. That is the usual result of a first replay: the approval holds and the record around it is thinner than anyone expected. It is why running one before somebody asks is worth more than running one afterwards.

For your reviewers

Deterministic replay. Identical inputs, policy version and evidence give an identical outcome on every replay. Typed facts carry derivation lineage, and decision and policy pack versions are pinned at evaluation.
Complements what you already run. Trace does not duplicate your GRC, ITSM or collaboration systems and is not a replacement for any of them. It holds what they were not built to keep.
AI can draft a narrative afterwards. It cannot prove what existed at the time.
Deployment options and the data boundary are first-conversation controls, agreed at the Diagnostic and put in writing for your reviewers.

Which decision is hardest to defend next month?

Bring that one. The Diagnostic compares your current reconstruction with a Trace-style replay — fixed scope, fixed price, one decision class first.

Book the Diagnostic → Not ready? Take the two-minute check