A decision ledger is a controlled log of human judgments made when a process hits an exception. It records what was decided, why it was decided, who approved it, and how the exception should be handled next time. In process mining and automation, this turns informal workarounds into auditable knowledge that can be folded back into a process map.
In cyber security, the ledger matters because automation is only as trustworthy as the exceptions behind it. A protected ledger supports audit trails, version control, and review of policy changes. If it is poorly controlled, an attacker or insider could hide unauthorized workarounds, poison the process map, or create drift that downstream bots inherit. Defenders use decision ledgers to spot recurring exceptions, enforce approval workflows, and keep automated actions aligned with policy.