Digital Signatures

The Digital Signatures area collects legally-meaningful sign-off on policies and governance documents. Use it to request signatures from internal users and external parties, track who has signed, and keep a defensible record of consent for audit and regulatory purposes.

1. Background and Business Purpose

Some governance records are only valid once the right people have signed them. Digital Signatures turns that sign-off into a controlled, trackable process: a request names the signers, sets an order and an expiry, and records each signature, decline, or cancellation.

Main business outcomes:

• collect formal sign-off on policies and governance documents
• support both internal users and external email signers
• enforce a signing order when approvals must be sequential
• give signers a clear pending queue and a simple way to sign or decline
• preserve a complete, auditable signature trail

2. Core Records and Actors

Item	Meaning
Signature request	A request to collect one or more signatures on a policy or governance document, with signers, order, and expiry.
Internal signer	A platform user asked to sign; finds the request in their pending-signatures queue.
External signer	A signer without a platform account who signs through an emailed single-use token link.
Signature	A signer's recorded sign-off, captured by drawing or typing.
Decline	A signer's refusal to sign, recorded with a reason.

Actor	Responsibility
Requester	Creates the signature request, sets signers, order, and expiry, and can cancel a pending request.
Internal signer	Reviews and signs or declines from the pending-signatures queue.
External signer	Reviews and signs or declines through the token-gated public page.
Auditor	Reviews the signature trail, order, decline reasons, and outcomes.

3. Creating a Signature Request

A signature request is raised from a policy or governance document.

1. Open the policy or governance document.
2. Start a signature request.
3. Add signers as internal users or as external email signers.
4. Set the signing order if signatures must be collected sequentially.
5. Confirm the expiry. By default a request expires in about 14 days.
6. Send the request.

Requesting signatures requires the signatures.create permission. The area is gated by the signatures feature flag, so it is only available when that flag is enabled.

4. Signing as an Internal User

Internal signers see requests assigned to them in the pending-signatures queue.

1. Open the pending-signatures queue.
2. Open the request to review the document.
3. Sign by drawing a signature or typing one.
4. To refuse, decline the request and provide a reason.

The current signer is identified by their user identity, so each person sees and acts on only the requests that are theirs to sign.

5. Ordered, Multi-Signer Requests

A request can require several signers. When a signing order is set, signatures are collected in sequence: each signer acts in turn, and the request advances to the next signer only after the current one has signed. The current signer is determined by user identity at each step.

The requester can cancel a request while it is still pending or in progress, which stops any further signing.

6. External Signers

A signer who does not have a platform account signs through a token-gated public page.

• The external signer receives an emailed single-use token link to the public signing page at /external-sign/:token.
• The page is token-gated: it can only be opened with the valid token from the email.
• The token expires with the request, so the link stops working once the request has expired or been completed.

External signers review the document and sign or decline in the same way as internal signers, without needing to log in.

7. Permissions and Availability

Item	Detail
Feature flag	The signatures feature flag must be enabled for the area to be available.
signatures.create	Required to create and send a signature request.

8. Related Pages

Related Page	Why It Matters
Governance Documents	Governance documents are sent for signature before they are published.
Governance	Policies can require sign-off through digital signatures.