[C2] 21 CFR Part 11 electronic signatures

[anmolg1997]

Workstream: gxp | Estimate: 8d normal → 4d AI-assisted | Phase: 2 | MVP gate 🔴

Why

Every eBR competitor advertises this; reports cannot be finalized without it. §11.50/70/200/300: two components, name+time+meaning displayed, permanently record-linked.

Scope

• Signing ceremony (re-auth + meaning selection)
• Signature block on PDF reports; record-linked, non-detachable
• Password policy + unauthorized-use detection hooks

Acceptance criteria

• Signed report displays signer/time/meaning; record hash binds signature
• Second component required at signing even with active session

---

From the enterprise-readiness backlog (codebase audit + pharma/GxP research + tooling survey, 2026-06-12).

[anmolg1997]

⬆️ Elevated by the product reframe. Two-factor electronic signatures are now required on the regulated approval actions the MVP introduces: Profile approval (Site Head), Work Item approval (Reviewer), Finding acknowledgment, and (Phase 2) CAPA closure — per VISION.md §11. So C2 moves from a later GxP item to a dependency of Stages 0/4/5. Kept (foundation).

See planning/RECONCILIATION.md (PR #156) for the full product↔engineering mapping.

[anmolg1997]

Elevated — e-signatures are now a foundation dependency for the MVP, not a later add. Required for: Profile approval/rejection (PROFILES_FEATURE_SPEC §8.1 / §9.6 / acceptance lines 319 & 325 — mandatory comment on approve/reject), Work Item approval, and Finding acknowledgement (VISION §11).

Author ≠ approver SoD on the Profile approval e-sig (PROFILES §8.1, resolved decision #7, acceptance line 325): the e-signature flow must enforce that the user who authored a Profile cannot be the one who approves it — a Site Head (or Support Site Head in default mode) approves, never the author.

CUSTOMIZATION_ARCHITECTURE generalizes this as "configuration as a controlled artifact" — versioned / approved / audit-trailed / e-signed. Feeds the Stage-0/4/5 approval actions in M1 (#158), M5/M6 (#161). See RECONCILIATION §4.6.

[anmolg1997]

Data layer landed — spec 013 (PR #238): Signature record + version binding_hash + author≠approver SoD + one-time SignatureDeclaration. Remaining: 2FA/TOTP/re-auth signing mechanics → 04-SECURITY.