Observability tells you whether the model is behaving. This answers a different question: what did the system do, who was accountable, and can you prove nobody edited the answer.
nothing is written down
Four actions. No record.
the logs have rotated
Nothing conclusive, and no way to get it.
each row seals the one before it
Verified — chain intact, countersigned outside.
Every export is a self-contained bundle. The verifier recomputes every hash, checks every link, validates the checkpoint signatures against the published key, and says what is proven. It runs offline, with no account and nothing from us.
A record only we can check is a claim. This is the part that makes it evidence.
Verification, in detailnode -e "const b=require('./evidence.json');require('fs').writeFileSync('verify.mjs',b.verifier)"
node verify.mjs ./evidence.json✗ TAMPERED — this record has been altered
FAIL seq 4182: Content altered at 4182: stored bb1074a2c9e1…,
recomputed 0e41f7d3ba58…Most tools pick one capture technique and call it coverage. A gateway sees model calls but not tool execution. An SDK sees everything but needs your source. We use all four, and say what each can and cannot prove.
| Plane | How | What it proves | To turn on |
|---|---|---|---|
| Model | An AI gateway | Every model call from every agent, including agents whose source you don't control. | Config change. No code. |
| Action | Two-line SDK | Tool calls, retrievals, decisions and their reasons — captured in-process via OpenTelemetry. | Two lines in your agent. |
| Edge | Vendor hooks | Voice turns, AI disclosures, coding-agent sessions. What the vendor observed. | A webhook URL. |
| Effect | Git, cloud, ledgers | The change that actually landed — the commit, the payment, the config change. | Read-only API access. |
A voice agent booking an appointment and a deploy bot pushing to production have nothing in common operationally, and exactly the same shape as evidence.
Each event carries the hash of the one before it, computed over a canonical form so two implementations agree to the byte. Rewriting one field breaks every link after it, and the verifier names where the break starts.
Recomputing the whole chain would repair those links — which is why the head is signed every five minutes and countersigned by an independent timestamp authority. A rebuilt chain no longer matches a checkpoint that was witnessed before the rebuild.
In storage, UPDATE and DELETE on the event table are refused by database trigger, so a direct connection that bypasses the application is refused too. A test opens the file raw and proves it.
Events are provably unaltered from the moment
their checkpoint anchors.
The exposure window = the checkpoint interval
= 5 minutes by default.
Same trust structure as the audit logging your
cloud provider already ships. Twelve times tighter.Who acted, which tool, when, the outcome, the policy decision, and the SHA-256 of every input and output. Never the payload.
Raw payloads land in your own bucket; we hold the chain and metadata. Drill-down without granting custody.
Payloads with us, for teams that prefer the convenience. Not the default, and never for health or cardholder data.
Payload deletion uses a tombstone: the content is destroyed, the hash remains, and the chain still verifies. A GDPR erasure does not break the record.
Record it first. Enforcewhen you're ready.
Nothing is enforced until you arm a rule. The first week costs you a chain that is already there when somebody asks, and nothing else.