Observability tells you whether the model is behaving. This answers a different question, for a different person: what did the system do, who was accountable, and can you prove the answer wasn't edited after someone complained.
Every export is a self-contained bundle. The verifier recomputes every hash from the raw events, checks every link, validates the checkpoint signatures against the published key, and says what is proven. It runs offline, with no account and nothing from us.
A record only we can check is a claim. This is the part that makes it evidence.
Verification, in detailnpx @auditant/cli verify ./evidence.json --offline✗ TAMPERED — this record has been altered
FAIL seq 4182: Content altered at 4182: stored bb1074a2c9e1…,
recomputed 0e41f7d3ba58…Most tools pick one capture technique and call it coverage. A gateway sees model calls but not tool execution. An SDK sees everything but needs your source. We use all four and are explicit about what each one can and cannot prove — because coverage is a configuration fact, and no signature can make an action that never reached us appear.
| Plane | How | What it proves | To turn on |
|---|---|---|---|
| Model | An AI gateway | Every model call from every agent, including agents whose source you don't control. | Config change. No code. |
| Action | Two-line SDK | Tool calls, retrievals, decisions and their reasons — captured in-process via OpenTelemetry. | Two lines in your agent. |
| Edge | Vendor hooks | Voice turns, AI disclosures, coding-agent sessions. What the vendor observed, on their side. | A webhook URL. |
| Effect | Git, cloud, ledgers | The mutation that actually landed — the commit, the payment, the config change. Ground truth. | Read-only API access. |
A voice agent booking an appointment and a deploy bot pushing to production have nothing in common operationally, and exactly the same shape as evidence.
Each event carries the hash of the one before it, computed over a canonical form so two implementations in two languages agree to the byte. Rewriting one field breaks every link after it, and the verifier names the sequence number where the break starts.
Recomputing the whole chain would repair those links — which is why the head is signed every five minutes and countersigned by an independent timestamp authority. A rebuilt chain no longer matches a checkpoint that was witnessed before the rebuild.
In storage, UPDATE and DELETE on the event table are refused by database trigger, so a direct connection that bypasses the application entirely is refused too. There is a test that opens the file raw and proves it.
Events are provably unaltered from the moment
their checkpoint anchors.
The exposure window = the checkpoint interval
= 5 minutes by default.
Same trust structure as the audit logging your
cloud provider already ships. Twelve times tighter.That the log is complete. An action that never reached Auditant is not in it, and no signature can say otherwise. Coverage is answered by your deployment configuration, and the report never conflates the two.
Who acted, which tool, when, the outcome, the policy decision, and the SHA-256 of every input and output. Never the payload.
Raw payloads land in your own bucket; we hold the chain and metadata. Drill-down without granting custody.
Payloads with us, for teams that prefer the convenience. Not the default, and never for health or cardholder data.
Payload deletion uses a tombstone: the content is destroyed, the hash remains, and the chain still verifies. A GDPR erasure does not break the record — which matters, because a compliance control that conflicts with another compliance duty is not usable.
Recording is the first third. Next: the rules that run before an action, and what the fleet costs.