Automatic capture
Evidence comes from the same records agents write. No manual collection step, no second system to maintain.
Governance
Audit Trail and Evidence
A hash-chained audit trail where every step, tool call and approval decision is recorded with the evidence attached. Each entry includes a hash of the one before it. No record can be changed after the fact.
How the audit chain works
Every entry proves the one before it.
The chain is append-only. Each record carries a hash of the previous record, so altering any entry breaks the chain from that point forward.
Agent acts
Every model call, guardrail check and tool execution writes an entry to the audit log.
Hash-chain links
Each entry includes a hash of the previous entry, creating a tamper-evident chain that breaks if any record is changed.
Tenant-scoped
Every record belongs to a tenant, enforced by row-level security in the database. One tenant cannot see another's trail.
Verifiable
Anyone with access can verify the chain has not been altered. Each hash proves the entry before it was unchanged.
Evidence collection
Evidence from the same records agents write.
Evidence is not a separate workflow. It comes from the audit entries the platform already creates on every governed step.
SHA-256 integrity
Every piece of evidence is hashed at rest. The hash travels with the record so integrity is verifiable at any time.
HMAC signatures
Records are signed with a per-workspace key. A signature mismatch means the record was altered outside the platform.
Auditor packs
Export evidence per framework with source references and verification metadata. One pack per audit, ready to hand over.
Offline verification
Auditor packs include a key and a script so verification works without the platform. Your auditor does not need a login.
Compliance snapshots
Quarterly posture snapshots frozen for your records. Each snapshot captures the state of every control at a point in time.
What gets recorded
Five event types on the same chain.
Every governed action writes at least one of these entries. Together they reconstruct the full decision path for any agent step.
Model calls
Every LLM invocation with the prompt sent and the response received, under the policy that routed it.
Guardrail results
Every predicate check with its pass or fail result. The guardrail name, input and outcome are all on the record.
Tool calls
Every tool invocation with the input arguments and the output returned, including whether the tool was on the allow list.
Approval decisions
Who decided, what they chose and why. The decision carries the verified identity of the person who made it.
Evidence files
Documents uploaded as supporting evidence, each stored with a SHA-256 hash so the content can be verified later.
An audit trail your auditor can verify.
We will walk through a real chain, show an evidence pack and run the offline verification script.