--- title: "Use case: Produce audit evidence for AI agents that an auditor accepts" canonical_url: "https://tokenobserve.com/use-cases/audit-evidence-for-ai-agents" published: 2026-09-02 last_updated: 2026-10-21 --- # Use case: Produce audit evidence for AI agents that an auditor accepts Hand over one bundle from Token Observe that carries its own verdict rather than a folder of exported logs. It holds the traces and events for a period, the approvals with approver identity and rationale, the audit entries for every governance-plane change, a verification of the hash chain, and a SHA-256 digest over the canonical JSON of the body. ## The stated limit What a valid flag means: Nothing was altered without recomputing; read the protection level ## A folder of exports says nothing about itself. Framework logs, a provider usage report and a spreadsheet of who approved what are all produced by, or about, the party under examination. An append-only table enforced by database permissions is better and still fails the threat model that matters, which has to include the operator. A restore drill that passes verification proves nothing, because lopping entries off the end leaves every remaining link valid. ## The steps, in this order 1. Key the chain while it is short. Inject an audit MAC key from a secret manager your database administrators cannot read. The guarantee is forward-looking, so waiting costs a weaker prefix. 2. Anchor off the box. With an Ed25519 key set, the chain head is signed daily to a sink you do not administer. Any copy you retained beats any later rewrite. 3. Record the head out of band. Write the attested head sequence and entry count down outside the deployment, then pass them back to the verification endpoint after a restore. 4. Export, and read the truncation flags. Traces, events and audit entries each set a flag when their cap bites; the approvals cap sets none, so read that count against your period. ### The protection level is the field to read first. A bare valid flag invites the reader to assume more than an unkeyed chain offers: it means nothing was altered without recomputing, not that nothing was altered. The seal is a SHA-256 over the canonical JSON of the body, not a signature. It confirms the file matches a digest given through another channel, and anyone who can rewrite the bundle can recompute it. - Refusals are in it: The trace opens at step 3, before sanitisation and before the verdict, so a request blocked a millisecond later is recorded rather than missing. - Shadow decisions are in it: Every rule that matched writes a decision event naming the policy, its mode and why it matched, so an observing rule leaves evidence it ran. - The read is in it too: Listing, searching, opening and exporting each append an audit entry, and the export entry carries the digest of the bundle it issued. - Not in it: Hidden model reasoning at every setting, training-data provenance, model cards, and anything about an agent that never routed through Token Observe. Prompt and reply text are absent only while capture is left at its metadata default; set ACP_CONVERSATION_CAPTURE=redacted and both are written as evidence, mask-redacted and bounded. ### Three layers of integrity, and what each moves the target to. The bare hash chain is tamper-evidence and is the default, and a verification walk names which failure it found: a link mismatch, a content mismatch, or a sequence gap, including a missing prefix, because deleting entry 1 and recomputing from genesis leaves a chain that checks out link by link. Keying moves the target to whoever holds the key; anchoring moves it again, and refuses to sign when the chain does not verify. ## What this still does not solve - There is no Merkle tree and no inclusion proofs, so a verifiable subset of the log means handing over the rest of it. - There is no trusted timestamp. An anchor's creation time is inside the signed bytes, but only a timestamp authority proves when. - Nothing survives host compromise. Anyone who reads the audit MAC key or the anchor private key can produce a history that verifies. - An audit entry cannot be removed without breaking verification onward, so the governance-plane log is the wrong place for anything you may have to erase. ## Questions and answers Q: Is the audit log tamper-proof? A: No, and Token Observe will not use the word. Unkeyed, which is the default, the chain is tamper-evident: any edit that does not also recompute every downstream hash breaks verification at a named sequence. An operator with write access can recompute it, and the repository's own forgery test asserts the forged chain passes. Q: Are compliance exports signed? A: No. A bundle is digest-sealed with a SHA-256 over the canonical JSON of its body, and it carries the verification verdict, the entries checked and the protection level. That digest is not a signature. The Ed25519 signature lives on the anchors. Q: Is the prompt and reply text in the bundle? A: That depends on one setting, and it belongs in your covering note. Under the default metadata capture mode no message text is stored at all. Set ACP_CONVERSATION_CAPTURE=redacted and both the prompt as sent and the assistant's reply are written as evidence, mask-redacted and bounded at 32,000 characters.