Supplier Assurance
What it is
Supplier assurance (/assurance) is the relying party's portfolio: every supplier that
shared signed proof with your organization, claim by claim. For each
claim you see whether the supplier's current receipt is still fresh and how the claim moved
compared with the receipt before it.
It shows labels, the signed statement, dates and basis. It never shows raw evidence; the API returns none.
When to use it
To keep an eye on the suppliers you asked for proof, instead of re-reading receipts by hand. It tells you which claims are still current, which have gone quiet, and which got worse.
Before you start
- Tier: every tier, Free and up.
- Role: any member can read it. Asking suppliers is OWNER or ADMIN; see Relying-Party Desk.
- Data: a supplier appears once it has accepted your request. Until then there is nothing to show.
How to
Read the portfolio
Each supplier is a card with one row per granted claim. A claim is in one of four states:
| State | Meaning |
|---|---|
| Current | A receipt is shared and its freshness window has not passed. |
| Stale | A receipt is shared but its freshness window has passed. It means the supplier has not re-issued it, not that anything got worse. |
| No receipt yet | The grant is active, but no current receipt of this claim has been delivered under it. |
| No longer shared | The grant was revoked or has expired, so nothing is shared and nothing is shown. |
Alongside the state, drift compares the last two receipts the supplier shared with you for the same claim:
- Worsened and Improved compare the share of items met in the two receipts. Items whose state is unknown are never counted as met, so a rise in unknown items lowers the reading.
- Unchanged means the reading did not move.
- First receipt means no earlier receipt of the claim was shared under this grant.
- Not comparable appears for a self-attested claim, or one with nothing measured. Such a claim is never shown as Unchanged, because nothing was compared. Drift compares like with like: a score is compared with a score, and a ratio with a ratio.
By default the page shows active grants. Switch the status filter to include revoked and expired ones.
Verify a receipt
Every receipt row has a Verify link and a Download receipt. The download is the receipt file exactly as signed, and the verifier checks it against the supplier's own published keys, so checking a receipt does not depend on CMDash. See Verifying a proof receipt.
Export to a spreadsheet
Export CSV downloads the portfolio, one row per supplier and claim: labels, ids and dates only, never evidence. It stops at 500 suppliers and says so in the file when it does, and any cell that could open as a spreadsheet formula is neutralised.
Get told when something changes
Three alerts watch your suppliers. A rule for each is created for your organization the first time you send a proof request:
| Alert | Fires once when |
|---|---|
| Supplier proof worsened | A newly shared receipt shows a weaker state than the one it replaced. |
| Supplier proof went stale | A receipt shared with you passes its freshness window and no newer one has been delivered. |
| Supplier revoked your proof access | A supplier withdraws a grant you held. Receipts already delivered stay verifiable. |
The worsened and stale checks run in the daily lifecycle sweep, so an alert can follow the event by up to a day; a revocation alert is raised when the revocation happens. Each alert fires once per event: a repeat run over the same state sends nothing.
Alerts carry the claim id, the supplier's display name, the state and a path to the desk. They
never carry a measurement, a score, evidence, or the claim's statement text. The three default
rules have no chat or e-mail channel selected: the alert is recorded in the automation log and
sent through the alert.triggered webhook, and you add a channel by editing the rule
(Notifications and alerts).
Common questions
Why does a claim say "Not comparable" instead of "Unchanged"? Because a self-attested claim has nothing measured to compare. CMDash does not present a missing comparison as a stable one.
Does Stale mean the supplier failed? No. A stale receipt can still be genuinely signed; it is past its stated freshness window, and a newer one has not arrived.
Can I see why a supplier's number changed? No. You see what the signed receipts say, never the evidence behind them.