A check reads paperwork. A person answers for it.
Why does a release need a person when the checks already ran?
Because a check reads paperwork and a person answers for it. The product computes; a named person decides what to rely on.
A clean set of checks is evidence, not a decision. Whether to use a lot for this preparation, from this supplier, at this dose, is the pharmacist's call, and the record has to show that someone made it. So the rule lives on the server, not in the browser, and it is asked on every path that lets something leave a lot: the dashboard, the API, order fulfilment, Vera's release plans, automatic release, Seal minting and custody shipments.
No person has reviewed lot BM-5520. Its documents cleared on their evidence; nothing is issued from it until a person records what they checked and relied on.
Six parts on every lot. A decision readable in a minute.
What must every review show before anyone relies on it?
Six parts, in the same order on every lot, so a reader can state the decision in under a minute.
Methodology v1.0 published these six parts as release gates. Each maps to something the product now shows, listed in the third column, and a record missing one is not ready to hand to anyone. They are what a review shows; the eight reasons further down are what the server refuses on.
| Part | What the reader sees | How the review delivers it |
|---|---|---|
| The verdict | One plain heading: Verified, Verified where checked, Your call, or Not verified. | Not verified says how many checks were not met and names them. A check that could not run is named and never counted as passed. |
| The evidence map | Every value tied to the page and line it was printed on, quoted word for word. | A field the certificate does not state is shown as not stated, never guessed. The text as read opens beside the review, numbered as the citations count it. |
| The replay | How the verdict was reached, check by check. | 20 checks in four groups, each naming the standard it rests on, and every lane saying ran, not applicable or could not verify. The original is kept as received, with its SHA-256 fingerprint. |
| The boundary | What the record does not claim, printed on it. | We read documents. We do not test material. Document-integrity findings are signals for a person, never a verdict of forgery. |
| The next action | The one thing to do next, and who does it. | Anything short of a pass says what failed, why, what passes and how, with the button to do it. A request to the supplier is drafted from the gaps. |
| The export | A record that can travel. | A Passport per dispensed order, a numbered custody statement per lot, and a read-only records room for an inspector that stops answering once closed. |
Some findings hold on their own. A signature never clears them.
What holds a lot before anyone is asked?
Some findings hold the lot on their own. A person can look, but a signature never clears them.
| Finding | An example | What it rests on |
|---|---|---|
| No manufacturer named | The certificate names the seller and leaves the maker off. | 21 U.S.C. 353a(b)(1)(A)(ii) asks for the original manufacturer. |
| Dates that cannot all be true | Tested before it was made. | The certificate's own calendar, ICH Q7 11.41. |
| A result outside its own limit | 96.1% marked Conforms against a limit of 98.0 to 102.0%. | The certificate's own numbers. |
| A retest or expiry date that has passed | A retest date already behind the day the certificate is read. | The ICH Q7 glossary's retest and expiry dates. |
| The laboratory says it did not issue the report, or that it differs | A recorded reply from the issuing laboratory. | The issuer's own word. |
| A high file-metadata contradiction | A PDF created long after the issue date it prints. | The file's own bytes. |
| An AI-generation assertion in the file's content credentials | The document's own C2PA manifest. | The file's own declaration. |
| A recall signal | An openFDA enforcement match, or a recall a person declared. | Public enforcement records. |
| A label a person says does not match | The label against the paperwork, at receiving. | The person at receiving. |
| A field the Second Reader contests | Where an AI model is set up, a second read quotes a different line. | Both readings stay side by side for a person. |
Two things never hold on their own. A substance on FDA's Category 1 list (substances under FDA's January 2025 interim policy) is shown, with the list's date, and left to the pharmacy. (A Category 2 substance holds the lot in every release policy, and no setting can switch that off, because FDA's interim policy does not extend to it.) A certificate issued after its lot's expiry does not hold, because a reprint for an old lot does exactly that. A substance with none of the three 503A routes is the opposite case: it holds on every path, and no review answers it.
Eight reasons nothing leaves a lot. Asked in order, on every path.
What are the eight reasons nothing leaves a lot?
The server asks them in this order and answers with the first that applies, in words an operator can act on.
| The server refuses when | What clears it |
|---|---|
| The lot carries a recall signal. | A person judges the recall. |
| A person has the lot on hold. | A person lifts the hold, with the reason. |
| None of the three 503A routes applies to the substance. | Nothing. No review or recorded basis answers it. |
| The lot was made from an ingredient lot that is held. | The ingredient lot is resolved. |
| The lot is not cleared. | Its evidence clears. |
| The lot was made from an ingredient lot no person has reviewed. | Someone reviews that ingredient lot. |
| A purchased lot has no certificate read against it. | Add the certificate, fetch it, or ask the supplier through its door. |
| No person has reviewed the lot. | A person records what they checked and relied on. |
The same eight apply to a Passport, a Seal and a shipment. A clinic that receives a unit sees whether a person at the pharmacy reviewed its lot, and a preparation made from a held ingredient lot is held with it.
A name, a time, a meaning. And the record as it stood.
What does a person's review record?
A name, a time, a meaning from a fixed list, and the record as it stood.
A signature carries the printed name, the date and time, and what it means, chosen from a fixed list for that kind of record. For a lot decision it reads:
I reviewed the evidence and I am responsible for this decision.The fixed meaning of a lot decision signature
The server stores the hash of the record as it stood, so a later change shows as record changed since signing.
- One chain per workspace. Each signature stores the hash of the one before it, so an edited or removed signature breaks the chain and the page says so.
- Nothing is deleted. A signature made in error is answered by a later signed record, never erased.
- A signature clears no finding. A newer clean certificate lets a person set an older finding aside, with a reason, and both stay on file.
- It is the person's attestation, never an approval by Veritura. The signer is already signed in; the product does not ask for the password again at signing, and says so on the record.
Only what comes after a person looked.
What may a pharmacy's policy automate?
Only what comes after a person has looked. Release stays by hand until the pharmacy saves a policy that says otherwise.
| Policy | How Passports release | What it requires |
|---|---|---|
| No policy saved | By hand, every time. | The workspace has never recorded a choice. |
| Strict | By hand, every time. | A cleared lot, a complete and current supplier file at 100 percent completeness, a person's review, and a file for every supplier. Any enforcement or recall signal holds. |
| Standard | On a policy Allow. | A cleared lot and a current supplier file at 50 percent completeness or more. Any enforcement or recall signal holds. |
| Lenient | On a policy Allow. | Nothing beyond the public record: an enforcement or recall signal holds. |
Under every preset the server's rule still stands: a Passport issues automatically only from a lot a named person has already reviewed. A policy is a preset plus eleven named switches and one threshold, the minimum file completeness (the share of a supplier file's applicable items verified and still fresh), never a free-form rule language. Vera, the AI desk assistant, can stage a batch of Passports; a person's signature issues them. The policy is set, and each order decided against it, in ClearGate.
What a release never means.
What does a release not mean?
- A release means the documentation met the pharmacy's policy and a named person reviewed the lot. It never means Veritura approves the supplier, the product or the preparation.
- An Allow means the documentation meets the pharmacy's own policy. No decision ever means Veritura stands behind a supplier.
- Veritura reads documents. It does not test material, and every Passport says so on its face.
- Absence of a public-source match is not proof of absence.
Watch the gate hold a lot.
The live demo is a read-only workspace seeded with sample lots: every check, citation and hold, as the product shows them.