> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlasent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 21 CFR Part 11

> FDA regulation on electronic records and electronic signatures — which section maps to which AtlaSent primitive.

21 CFR Part 11 is the FDA regulation governing **electronic records and electronic signatures** in regulated life-sciences environments. When AI agents create, modify, amend, or sign electronic records, Part 11 applies.

## Requirement-to-primitive mapping

| § | Requirement | AtlaSent primitive |
| - | - | - |
| 11.10(a) | System validation | Policies are schema-validated on import; rule set is fingerprinted and version-locked. |
| 11.10(b) | Accurate and complete copies | [Signed audit bundle export](/quickstart/audit-export); verifiable offline. |
| 11.10(c) | Protection of records | Append-only, hash-linked [audit chain](/concepts/audit-chain); no UPDATE/DELETE possible. |
| 11.10(d) | Limiting access | Scoped [API keys](/api-reference/authentication#scopes) + role-based Console access. |
| 11.10(e) | Secure, computer-generated audit trails | Every `/evaluate` call produces an immutable chain entry, atomic with the decision. |
| 11.10(g) | Authorized signatories only | Policy rules enforce role-based authorization; overrides are attributable. |
| 11.50 | Signature manifestation | Ed25519-signed [permit tokens](/concepts/permit) linked to the action in the audit chain. |
| 11.70 | Signature-to-record linking | Permit ID stored in audit entry; inseparable from the action record. |
| 11.100 | Unique electronic signature | API key hash + actor ID + permit ID form a unique attributable tuple per action. |

## Starter policy

A ready-made Part 11 starter policy (`gxp-starter`) is not yet publicly available. Its core rules:

```json theme={null}
[
  { "action_type": "ehr:read",              "decision": "allow" },
  { "action_type": "ehr:write",             "decision": "allow" },
  { "action_type": "ehr:amend",             "decision": "allow" },
  { "action_type": "ehr:delete",            "decision": "deny",   "reason": "§11.10(e): records must not be deleted" },
  { "action_type": "audit:delete",          "decision": "deny",   "reason": "§11.10(e): audit trails must be secure and unalterable" },
  { "action_type": "export:unsigned",       "decision": "deny",   "reason": "§11.50: export requires electronic signature" },
  { "action_type": "export:signed",         "decision": "allow" },
  { "action_type": "audit:disable",         "decision": "deny",   "reason": "§11.10(e): audit trails must be active at all times" }
]
```

## Permit tokens as signatures

Under §11.50, an electronic signature must be linked to its record so it cannot be excised, copied, or transferred. AtlaSent's [permit token](/concepts/permit):

1. Is an Ed25519-signed JWT containing agent ID, action type, policy ID, and timestamp.
2. Has its ID stored in the audit chain at evaluation time.
3. Must be stored alongside the action's record in your own system.
4. Is verifiable via `POST /v1-verify-permit`, producing a yes/no answer plus the reason.

## Implementation checklist

* [ ] Import a 21 CFR Part 11 starter policy. (The `gxp-starter` policies are not yet publicly available; until they are, author the equivalent rules for your organization.)
* [ ] Set a stable, human-readable `actor.id` for each AI agent.
* [ ] Store `permit_id` with every record modification.
* [ ] Ensure `ehr:delete`, `audit:delete`, and `audit:disable` rules are `deny`.
* [ ] Export and archive audit bundles monthly. [Audit export →](/quickstart/audit-export)
* [ ] List AtlaSent policy ID + version in your system validation documentation.
* [ ] Review override frequency monthly — high override counts indicate policy needs rewriting.

## Related

<CardGroup cols={2}>
  <Card title="Audit chain design" icon="link" href="/concepts/audit-chain">
    How the chain is hash-linked and signed.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.