Integrity Service Troubleshooting

Use this page for first-line checks when lineage, manifest, certificate, or credential-status workflows fail.

Lineage Graph Is Missing

Confirm lineage is enabled for the deployment, Integrity Service is ready, and the user holds the view_project_data permission on the project. Integrity Service authorizes lineage reads through Auth Service RBAC, and the symptom tells you which check failed:

• A graph list that is empty or missing entries. The list endpoint filters to the projects where the caller holds view_project_data, so a missing graph means the caller has no permission on that graph’s project.
• A 403 on a single graph or a policy manifest. Requesting one graph directly returns 403 when the caller lacks view_project_data on its project, rather than returning nothing.

An empty list and a 403 point at different problems: the first is usually the wrong project or a missing membership, the second a caller who reached the right graph without the permission to read it.

Certificate Issuance Fails

Confirm Governance Service can reach Integrity Service, signing configuration is healthy, and the supporting policy and evidence records are available.

Credential Status Is Unexpected

Confirm whether the credential was revoked, the applied policy was archived, or the certificate workflow was retried. Revoked credentials should not be treated as active evidence.

Manifest Is Missing or Incomplete

Confirm the policy, subject, declarations, reviews, and related evidence were available when the manifest was created.

Blob Storage Errors

When Integrity Service cannot reach or read its configured blob store, it returns 503 Service Unavailable with: “Integrity Service blob storage is unavailable or misconfigured. Check the configured provider, bucket/container, region/folder, credentials, permissions, and network access.” Check the configured provider’s credentials, container or bucket name, and network reachability from the service.

Escalation Information

When escalating, include the project, policy or certificate, approximate time, affected workflow, and whether Governance Studio shows an error. Do not include private key material or sensitive evidence contents in tickets.