Traceability

When your domain's source code is in a Git repository, the generated domain.yaml automatically includes identity and metadata from the current commit. This improves traceability, as the domain identity is also recorded in the audit logs: for each authorization decision, you can find the version of the domain that made it, and the commit it was built from.

Committing changes

git commit -m "ABAC-123: Permit consultants to access resources in their own location"
[master 50e57b7] ABAC-123: Permit consultants to access resources in their own location
3 files changed, 24 insertions(+), 2 deletions(-)

build/alfa/domain/ads/domain.yaml

identity: axiomatics-policy-devops-50e57b7
metadata:
  Commit-Message: "ABAC-123: Permit consultants to access resources in their own location"
  Author: John Doe <jdoe@acme.com>
  Git-Identity: axiomatics-policy-devops-50e57b7
policy:
  ...

To add your own metadata, such as the status of the domain or who approved it, write it in src/authorizationDomain/metadata.yaml, see Authorization domain layout. To set the identity yourself instead of the Git identity, for example to the version of your release or the number of your CI/CD build, set domainIdentity in build.gradle:

build.gradle

alfa {
    mainpolicy "acme.Main"
    domainIdentity = "acme-policies-1.4.0"
}

Git-Identity in the metadata then has the same value. The commit message and author are still added.

When ADS starts, it will display the domain it has loaded, similar to the following output:

INFO  [2025-02-20 17:30:56,822] com.axiomatics.audit.ads.admin: Domain with id axiomatics-policy-devops-50e57b7 was loaded

Similarly, each entry of the audit log contains the domain identity in DomainId. The following entry is shortened and formatted for readability:

ADS audit log

{
  "timestamp": "2026-10-29T14:16:54.329 CET",
  "level": "INFO",
  "audit": {"objecttype": "abac-audit"},
  "message": {
    "DomainId": "axiomatics-policy-devops-50e57b7",
    ... the content of the audit log message ...
  }
}

Domains in Authorization Hub

When you push a domain to Authorization Hub or ASM with DomainPushTo{environment}, ADM replaces the identity with its own domain id. The ADS that loads the domain from there shows ADM's id in its logs (Domain with id … was loaded and DomainId). The Git identity is kept in the metadata as Git-Identity: use it to trace the domain back to the commit. Each push also stores a change message with the task name and the Git commit in Authorization Hub.

Accountability

Traceability supports accountability: being able to show who changed a policy, why, who approved it, and how it was verified. An APD project, kept in Git, gives you:

• Who changed what, and why: the Git history of the project. The author and the commit message of the commit that the domain was built from are also in the metadata of the domain.
• Who approved a change: review changes with pull requests, and list the people who must approve changes to the policies in the CODEOWNERS file of the project, which Git platforms such as GitHub and GitLab use to require their review. You can also record an approval in metadata.yaml, as above.
• How a change was verified: the tests. Give each test a display name with the requirement it verifies, see Write tests, and keep the test report of each release, for example with a custom task, see Custom tasks.
• Which decision was made, for whom, and by which domain: the audit log of ADS. It has an entry for each access request, with the client that sent it, the request, the decision, and the domain identity. See Logging.