21 CFR Part 11

21 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures in regulated life-sciences environments. When AI agents create, modify, amend, or sign electronic records, Part 11 applies.

Requirement-to-primitive mapping

§	Requirement	AtlaSent primitive
11.10(a)	System validation	Policies are schema-validated on import; rule set is fingerprinted and version-locked.
11.10(b)	Accurate and complete copies	Signed audit bundle export; verifiable offline.
11.10(c)	Protection of records	Append-only, hash-linked audit chain; no UPDATE/DELETE possible.
11.10(d)	Limiting access	Scoped API keys + role-based Console access.
11.10(e)	Secure, computer-generated audit trails	Every `/evaluate` call produces an immutable chain entry, atomic with the decision.
11.10(g)	Authorized signatories only	Policy rules enforce role-based authorization; overrides are attributable.
11.50	Signature manifestation	Ed25519-signed permit tokens linked to the action in the audit chain.
11.70	Signature-to-record linking	Permit ID stored in audit entry; inseparable from the action record.
11.100	Unique electronic signature	API key hash + actor ID + permit ID form a unique attributable tuple per action.

Starter policy

A ready-made Part 11 starter policy (gxp-starter) is not yet publicly available. Its core rules:

[
  { "action_type": "ehr:read",              "decision": "allow" },
  { "action_type": "ehr:write",             "decision": "allow" },
  { "action_type": "ehr:amend",             "decision": "allow" },
  { "action_type": "ehr:delete",            "decision": "deny",   "reason": "§11.10(e): records must not be deleted" },
  { "action_type": "audit:delete",          "decision": "deny",   "reason": "§11.10(e): audit trails must be secure and unalterable" },
  { "action_type": "export:unsigned",       "decision": "deny",   "reason": "§11.50: export requires electronic signature" },
  { "action_type": "export:signed",         "decision": "allow" },
  { "action_type": "audit:disable",         "decision": "deny",   "reason": "§11.10(e): audit trails must be active at all times" }
]

Permit tokens as signatures

Under §11.50, an electronic signature must be linked to its record so it cannot be excised, copied, or transferred. AtlaSent’s permit token:

Is an Ed25519-signed JWT containing agent ID, action type, policy ID, and timestamp.
Has its ID stored in the audit chain at evaluation time.
Must be stored alongside the action’s record in your own system.
Is verifiable via POST /v1-verify-permit, producing a yes/no answer plus the reason.

Implementation checklist

Import a 21 CFR Part 11 starter policy. (The gxp-starter policies are not yet publicly available; until they are, author the equivalent rules for your organization.)
Set a stable, human-readable actor.id for each AI agent.
Store permit_id with every record modification.
Ensure ehr:delete, audit:delete, and audit:disable rules are deny.
Export and archive audit bundles monthly. Audit export →
List AtlaSent policy ID + version in your system validation documentation.
Review override frequency monthly — high override counts indicate policy needs rewriting.

Audit chain design

How the chain is hash-linked and signed.

Get Started

Console Guide

Use Cases

Core Concepts

Authorization Surface

Reference

SDKs

Integrations

Guides

Enterprise

Runbooks

Compliance

Trust

For Biotech CCOs

Requirement-to-primitive mapping

Starter policy

Permit tokens as signatures

Implementation checklist

Audit chain design

​Requirement-to-primitive mapping

​Starter policy

​Permit tokens as signatures

​Implementation checklist

​Related

Audit chain design

Requirement-to-primitive mapping

Starter policy

Permit tokens as signatures

Implementation checklist

Related