Audit evidence, every day
Every gate in the AI factory writes down what it decided and why. The evidence for your next audit is collected as you run, not rebuilt the month before.
What a decision record holds
One schema for every band, so a model promotion, a held document and a refused prompt can be queried together.
| Field | What it captures |
|---|---|
| Who | Tenant, user or workload identity, and the session |
| What | The model, dataset, agent or document, by version and hash |
| Which gate | Band, stage and the policy version that decided |
| Decision | Allow, hold or block, with a reason code and any scores |
| When | Timestamp, and the hash of the previous record in the chain |
How the record is kept
A control you claim is a control you can show, so the record has to survive scrutiny.
Append-only
Records are only ever added. Nothing in the platform can edit or delete one inside its retention period.
Hash-chained
Each record carries the hash of the one before it, so a gap or an edit breaks the chain and shows.
Retained
Retention is set per tenant to match your obligations, 365 days by default.
Forwarded
Normalised to CEF and OCSF and in your SIEM within seconds, so a copy lives outside the platform too.
What you hand an auditor
Each artifact, what it contains, and examples of the clauses it supports.
| Artifact | Contents | Supports |
|---|---|---|
| Decision records | Every gate decision, append-only and hash-chained | ISO/IEC 27001 A.8.15; EU AI Act Art. 12; NIST AI RMF Manage |
| ML-BOMs and attestations | Bill of materials per model, with scan results as in-toto attestations | ISO/IEC 42001 A.10; ISO/IEC 27001 A.5.21; OWASP LLM03 |
| Signatures | Sigstore signatures on models and datasets, logged to a transparency log | ISO/IEC 27001 A.8.24; OWASP LLM03 and LLM04 |
| Policy history | Every policy as code, versioned and reviewed | ISO/IEC 42001 A.2; NIST AI RMF Govern |
| Red-team reports | Findings by attack class and severity, run after run | EU AI Act Art. 15; NIST AI RMF Measure; ISO/IEC 23894 |
| Data handling records | PII actions per batch, provenance per chunk, key usage | PDPL regimes; ISO/IEC 27001 A.8.11; EU AI Act Art. 10 |
| Incident cases | AI events worked in your SOC, with playbook and outcome | ISO/IEC 27001 A.5.24 to A.5.28; NIST AI RMF Manage |
An audit, step by step
The same four moves, whichever framework the auditor is testing against.
- 1
Scope the systems
Export the inventory: every model, dataset, agent, skill and MCP server, with owner, version and approval.
- 2
Show the controls
Export the policy history: which rule applied at which gate, when it changed and who approved the change.
- 3
Prove they ran
Query the decision record for the audit period and verify the chain end to end.
- 4
Show the exceptions
Pull the blocks, holds, red-team findings and incident cases, with how each was resolved.