A batch record review flags a deviation. VAC seals who held Qualified Person authority to certify the release — and proves it, years after the moment has passed.

It starts in the batch record: a deviation on a finished-product lot surfaces during routine review, and a human decides whether the batch can be certified for release. When a Qualified Person certifies a batch under EU GMP Annex 16, the inspection question is not what the batch record shows — it is who held current QP authorisation to certify this product category at this site, at this moment, and whether that record has been altered since. VAC is the trust layer under the certification: it proves authority, identity, and provenance with a sealed, independently-verifiable receipt.

Representative scenario

Lot SX-2291-B · Finished-product sterile injectable · Site QU review

During routine batch record review for Lot SX-2291-B, the site's Quality Unit flags a deviation: an in-process bioburden hold-time excursion, investigated and closed as minor with no impact on product sterility assurance. The Qualified Person reviews the deviation report and the full batch record — process parameters, in-process controls, the investigation and its closure rationale — against the release specification.

The QP decides to certify the batch for release under EU GMP Annex 16. VAC is the mechanism that seals who certified, which lot, which deviation, and at exactly what time — producing a regulator-grade audit receipt that an inspector can verify against the production backend, without needing to trust VAC's word for it.

Walk through the authorisation, step by step

Sealed authorisation walkthrough

LIVE SEAL MECHANICS

"The part of the system that checks the work is never the part that did the work." The batch record review that flags the deviation does not certify the release. The Qualified Person who certifies does not operate the seal. The inspector who audits holds a receipt that neither party can alter after the fact.

Scenario — batch record review flags a deviation

Quality Unit batch record review · automated flag · no QP authority required at this stage

Batch record review flag · Representative scenario

Lot SX-2291-B — finished-product sterile injectable, batch record review.

Deviation flagged: in-process bioburden hold-time excursion (hold exceeded validated limit by 46 minutes).
Investigation status: Closed. Classification: Minor, no impact to sterility assurance.

Batch record review complete. All other critical process parameters and in-process controls within specification. Deviation investigation and closure rationale attached to the batch record for QP review.

Flagged for: Qualified Person review and release decision. If the QP does not certify, the lot is held pending further investigation or is rejected.

The batch record review and deviation flag are routine quality-system outputs — no authority is exercised here. Authority begins the moment a Qualified Person reviews the record and decides to certify it. That is the step VAC seals.

lot: SX-2291-B deviation: bioburden hold-time investigation: closed classification: minor release pending QP certification

Decision — Qualified Person reviews and decides to certify

Human decision · identity not yet verified · authority not yet sealed

The Qualified Person reviews the deviation report and the supporting batch record for Lot SX-2291-B — the process parameters, the in-process controls, the investigation into the hold-time excursion, and its closure rationale — against the release specification and the site's Product Quality Review requirements.

The QP decides to certify the batch for release under EU GMP Annex 16. At this point a decision has been made — but no authority has been verified and no record has been sealed. If the certification were logged only in the site's quality system, the audit trail would rest on that system's integrity. VAC replaces that assumption with a cryptographic proof: not just who clicked certify, but who held current QP authorisation to certify this product category at this site, at this moment.

decision: certify for release regulation: EU GMP Annex 16 identity not yet verified

Authority — VAC verifies current QP authorisation

VAC identity gate · policy-encoded conditions · authority chain minted

VAC checks that the certifying individual is:

A verified, present human — not a bot, not a replay, confirmed by live biometric at the moment of certification.
Holding current Qualified Person authorisation for this product category at this site (encoded in the QP's VAC credential, not asserted by the site quality system).
Acting within permitted conditions — product category, site, and certification scope all within the encoded QP authorisation for this batch class.

The authorisation conditions — product category, site, QP scope — travel with the authority chain. Not stored separately in a quality system that must be trusted; not asserted by the QP. The part of the system that checks the work is never the part that did the work.

identity: live biometric authority: current QP status conditions: within bounds policy: embedded in token

Seal — VAC seals who, what lot, and when

Ed25519 signed token · live production backend · independently verifiable

VAC mints a signed token (Ed25519 + JWT) that binds together:

Who — the verified Qualified Person identity (biometrically confirmed at the moment of certification, not just account-authenticated)
Which lot — the specific batch certified: Lot SX-2291-B, finished-product sterile injectable
Which deviation — the bioburden hold-time excursion, its investigation, and closure rationale as reviewed at the moment of certification
When — the exact timestamp, immutable, signed into the token — queryable in a regulator inspection years after the event

The token is signed by the VAC production backend. No party — not the QP, not the site quality system, not VAC — can alter this record after the fact without the signature failing verification. The batch record documents what happened; VAC proves who certified it and under what authority.

algorithm: Ed25519 format: JWT

Receipt — Regulator-grade sealed receipt, queryable after the fact

Live token · verifiable by JTI · tamper-evident

The sealed receipt is queryable by anyone who holds the JTI — a regulatory inspector, an auditor, the site's quality assurance team — against the live VAC backend. No trust in VAC required: the Ed25519 signature either verifies or it does not.

What a regulator-grade audit looks like with this receipt: the inspector queries the JTI — months or years after the release. The backend returns the signed token. The inspector verifies the signature against VAC's public key. The token's claims show the verified QP identity, which lot and deviation were certified, the product category and site the QP was authorised for, and the immutable timestamp. No internal quality-system access required. No trust chain back to the batch record archive. The batch record documents what happened; the receipt proves who certified it, and under what authority.

Authorisation sealed & lodged

Honest scope. The scenario above — Lot SX-2291-B, the bioburden hold-time deviation, the batch record details, the QP identity — is representative and labeled as such. The seal and receipt mechanics are real VAC system output: the token is genuinely minted, Ed25519-signed, and independently verifiable at the URL shown in the receipt. Certifying the batch (step 4) now runs the same live, multi-modal biometric ceremony financial-demo and tribunal-demo run at their sign-off/seal moment, and — when that ceremony completes — a genuine, server-audited /v1/vat/authorize gate call before the seal is presented as authorised; a clearly-labelled "Skip the live check (demo only)" link mints the same real, verifiable token under a sample identity instead, and the receipt states plainly which path produced it. The QP authorisation matrix and release conditions encoded in this token are illustrative placeholders; encoding a specific site's actual QP authorisation register, product-category scope, and deviation-classification rules is the integration build done with that site's Quality Unit.

The regulatory backdrop — EU GMP Annex 16 and Qualified Person certification

Annex 16 sets out the QP's personal responsibility for certifying that each batch has been manufactured and checked in compliance with EU GMP and the marketing authorisation, before it is released. A QP's certification decision is a named, individually accountable act — and inspectors expect that accountability to be provable, not merely asserted in a quality system record. Here is how a sealed-certification mechanism maps to that requirement — and it retrofits: the quality system and batch record process stay exactly as they are, and provable QP authority adds at the certification point through simple APIs. No rebuild required.

The Act, mapped → Platform capability map → Configure the retrofit → Start with an email approval →

The identity gate — try it yourself, live

The Qualified Person in this scenario doesn't type a password — they pass a live multi-modal biometric ceremony: face match, passive liveness, and a spoken-and-shown number challenge, run against the VAC production backend. This is the same ceremony the certify step (step 4, Seal) now runs before it will mint a live-bound seal (~60 seconds; the recording is analysed in real time and discarded — no photos or video retained). The session this ceremony mints is what binds the QP's certification to the sealed token below.

Try the live biometric →

✓ Verified, live, against production — this session now signs the certification

See how VAC applies across other regulated domains

The same two primitives — verified human authority and a sealed, auditable decision trail — applied to financial advice sign-off, legal trust & tribunal matters, and smart water network operations.

See the trust & tribunal demo →

What the seal proves: a verified, living Qualified Person held current authorisation for this product category at this site and certified this specific lot for release at this specific time — with a tamper-evident record an inspector can query independently, years after the event.

Honest scope · VAC is the trust layer under the certification: it proves authority, identity, and provenance. It does not run the batch record system and does not perform the quality investigation. The release decision in this scenario is made by the Qualified Person; the batch record and deviation investigation remain with the site's quality system. The quality system documents what happened — VAC seals who certified it. Cryptographic seal = tamper-evident provenance + regulator-grade audit trail, not a quality decision itself. The certify step's live check and its "skip (demo only)" alternative both mint a genuine, verifiable token; only the live path is bound to a verified human and carries a server-authorised seal_decision gate & audit record — the receipt states plainly which one produced it.