Evidence packet
Tamper-evident record of AI agent activity · log tenant_acme/prod · generated 2026-10-09T12:03:51.447Z
1 · The record
- Reporting window
- log genesis — 2026-10-09T12:03:51.447Z
- Events on the chain
- 4,827
- Chain head
- sequence #4,826 · tree size 4,827,
sha256:eaa652ba048d4b9e2e9dc5f… - Distinct agents
- 9
- Actions blocked by policy
- 181
- Actions held for human sign-off
- 0
- Signed checkpoints
- 184 (180 countersigned by an independent timestamp authority; 175 held in write-once Object Lock storage)
- Coverage score
- 89/100 — capture planes live: model, action, edge, effect
Stated limitations of this record (an honest packet names its own gaps):
- 1 agent quiet for over 24h — silence and a broken emitter look identical from here
- 2 of 4 traces observed on a single plane only — assertion, not corroboration
- 179 events carry cost the upstream did not price
2 · Framework readiness, computed from this record
A percentage per regime — with its denominator. Each figure counts only the obligations a runtime record can answer; obligations that no log can evidence (an impact assessment, a board-approved policy) are listed on the regime and excluded from the ratio. A rule that only watches is not counted as satisfied. The open obligations behind each figure are printed under it, because a percentage a reader cannot decompose is a claim, not evidence.
- A.6.2.4 Each system has defined operating limits, and something enforces them. open — Set daily spend ceilings for 5 agents.
- A.6.2.7 A system that stops reporting is noticed. open — Instrument the agents that stopped reporting.
- A.8.3 A person affected by a decision can be told the reason it was made. open — Arm the adverse-decision rule.
Every evidenceable obligation is answered from the record.
Every evidenceable obligation is answered from the record.
- A.8.16 Activity is monitored, and a gap in it is noticed. open — Instrument the agents that stopped reporting.
- §8(4) A decision against a person records why, in a form somebody can read. open — Arm the adverse-decision rule.
What the figures do not say:
- A percentage counts only what a runtime record can answer. 8 obligations across these regimes are outside the record — listed on each regime, never scored.
- Whether a clause is answered by the evidence mapped to it is a reading. Auditant states what the record proves; the assessor's reading is theirs.
3 · SEC 17a-4 / FINRA 3110 — supervision and records (in force today)
FINRA's 2026 Regulatory Oversight Report directs firms to track agent
actions and decisions and to be able to reconstruct the full chain of
activity. This record reconstructs that chain event-by-event: each action
carries who acted (actor), under whose authority
(onBehalfOf, approvedBy), what was checked
(policy), and what happened (outcome).
| Obligation | Where this record answers it |
|---|---|
| Records preserved in non-rewriteable, non-erasable form (17a-4(f)) | 175 chain checkpoint(s) are held in S3 Object Lock compliance mode (WORM) and countersigned via RFC 3161; the chain itself makes any post-hoc edit computable. |
| Supervisory review evidence (3110) | Policy decisions are recorded on the acted event: rule id, version, reasons, and — where a human signed — the approver's identity and timestamp. |
| Reconstruct the sequence of automated activity | Events are strictly sequenced per log; sessions and traces join related actions across capture planes. |
4 · EU AI Act Article 12 — automatic event recording (applies 2 Dec 2027)
Article 12(1) requires that high-risk systems "technically allow for the automatic recording of events (logs) over the lifetime of the system". Article 12(3) names specific data for biometric-adjacent systems; this schema carries those fields by name for every agent type:
| Art 12 requirement | Schema field | Status in this record |
|---|---|---|
| Period of each use (session start/end) | art12.periodStart / art12.periodEnd on lifecycle events | present |
| Inputs leading to the result | inputHash on every recorded action (payloads under the operator's custody) | present |
| Humans involved in verification | art12.humansInvolved plus approvedBy on human_override events | present |
| Automatic recording over the system lifetime | 4,827 events, appended at action time, never editable | present |
Retention: the record is append-only and its anchors are write-once; nothing in the pipeline deletes on a debugging schedule. (Article 19's six-month minimum is exceeded by construction.)
5 · Colorado SB 26-189 — consequential decisions (effective 1 Jan 2027)
| Obligation | Where this record answers it |
|---|---|
| Compliance records retained ≥ 3 years | Append-only chain with WORM-anchored checkpoints; retention is a property of the store, not a configurable cleanup job. |
| Adverse decisions carry a stated reason | Policy adverse-decision-requires-reason is enforcing: a decision against a person without a structured reason is refused, and the refusal is chained. |
| Meaningful human review on request | Every pending_approval / human_override pair is a chained review record naming the reviewer and their answer — grant or refusal. |
6 · Insurance underwriting — AIUC-1 control evidence
AI-agent liability underwriters condition coverage on governance evidence and price premiums against it. The six controls underwriters cluster on, and what this record shows for each:
| Underwriter control | Evidence in this record |
|---|---|
| Documented human kill switch | Tenant-level halt, forbid-wins over every other rule; each flip is chained under the operator's name. Currently: armed, not engaged. |
| Human-in-the-loop inventory | "Moving more than the threshold requires a named human to approve first." — enforcing. 0 action(s) held for sign-off in this record; every grant and refusal is a chained human_override event naming the reviewer. |
| Enforcement evidence on the existing stack | 181 action(s) blocked by policy in this record, each with the rule id, version, and stated reasons on the event itself. |
| Agent scope restriction | "An agent may only use the tools it was explicitly granted." — deny-by-default; out-of-grant attempts are blocked and chained. |
| Runaway-spend and loop guards | "An agent that exceeds its daily ceiling or loops too long is stopped." — spend ceilings and iteration caps evaluated before the action executes. |
| Tamper-evident activity record | 4,827 events, hash-chained; 184 signed checkpoints, 180 countersigned by an independent RFC 3161 timestamp authority. |
7 · Verify this record yourself
Request the evidence bundle for the same window — a single JSON file carrying the events, checkpoints, public keys, and its own dependency-free verifier. On your own machine, with no network, no account, and nothing installed beyond Node.js:
node -e "const b=require('./bundle.json');require('fs').writeFileSync('verify.mjs',b.verifier)"
node verify.mjs ./bundle.json
The verifier recomputes every event hash, re-links the chain, checks each checkpoint signature against the public keys below, and validates the RFC 3161 countersignatures. It exits non-zero and names the exact sequence number at the first discrepancy. Tampering with any stored event — by the operator, by the vendor, by anyone — is computable from the bundle alone.
Public key attestable-b25066d53d5b:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv0tDQUUkvHF3JxnnLIyEHkf07Oec IoIVlZKGUWx4jjRlZoTldm+uHkj0Pnuz5eYfX0RxLYazYbqA125+nRLGuA== -----END PUBLIC KEY-----
Public key attestable-5645354b28b7:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvpCIhQnkjwifnTlq/hZ7Di4S+HWQ VaqGcZWnASFBglCQ57QQO+WJ4igigZCEyb6F6orPGM8HapvryWYCLb0sZA== -----END PUBLIC KEY-----
Public key attestable-1f22611c5644:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGQLzqbrtEr3CnqEdg0q99sTfxp0I NQuZ+dKbjFMSlPPIp5BoLpH6fS7/7GF7dANizE6N1kn+EmkSDD6vJllcNQ== -----END PUBLIC KEY-----
Public key attestable-54085e8a8656:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWuRChW10ezibHdsRndd0SCuCiQpy T4udJB0B4VlcDsDIif3MI1mGL4NSNeSK+LeBUU+iI20rfDmZlfmz6EHuvw== -----END PUBLIC KEY-----
Public key attestable-28e4bfbbdc22:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9hhlUY+YpfzMfI/uinNCtBdiMUkV GmWwEHV2ppUiZuO0YmKJaQGsEOI7BOy3g6N6QC7519zigSQXL1IcumKC8A== -----END PUBLIC KEY-----
Public key attestable-9e793a94bbf8:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnbtWUuB/A/rN0djY8SS2WWaQnmZ+ crUr0SfleT3G0fnCuQB6yXLUPJe4kYPoZ+FiT5ZkSlcxdXqS0J2u3uAkUA== -----END PUBLIC KEY-----
Public key attestable-055ccb166437:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEFp7gqFdTB71u53ZM0vO77otPpHy fLr+yfLL+aFtl0TWx/jyNUJMpzY8jMPAOrLGPJrX1The7nKhNgjXJ+mNbA== -----END PUBLIC KEY-----
Public key attestable-ec90224cbe71:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEhV4Us5fev02Qgh1lJDMtfl+uWrn /CfJDLJTY4JyVx1xNw4q5hxPkuKrzGwXCp3h0h6CLM4O3rPUkGuyQRMmKQ== -----END PUBLIC KEY-----
Public key auditant-f8c74da45461:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0KIFTEBE+CNXKJq+P30q6BZkAhVG T6uS3k2if1y5kkA/0fds18yNmw6kN+UOGa8zRMD45n5wWeU74L57zZ4Ljw== -----END PUBLIC KEY-----
Public key auditant-ec90224cbe71:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEhV4Us5fev02Qgh1lJDMtfl+uWrn /CfJDLJTY4JyVx1xNw4q5hxPkuKrzGwXCp3h0h6CLM4O3rPUkGuyQRMmKQ== -----END PUBLIC KEY-----