AI agent audit trail

An AI agent audit trail an auditor can verify

Logs show that an agent did something. An audit trail has to survive a sceptical reader: who acted, under whose authority, in what order, and whether anyone changed the record afterwards. Provantix signs each action at the source, chains it, and exports a bundle your auditor re-computes on their own machine.

Verify a sample export Download the verification kit Get an invite

What an agent audit trail has to hold

Who acted: the agent's identity, its accountable owner and the credential it used.
What it did: the action, the target system and the outcome.
In what order: a hash chain per source and day, so a record cannot be removed or reordered unnoticed.
Whether a person approved: the approval, policy and approver handle, where your application sends them.
What is missing: gaps are reported as gaps, never smoothed over.

Why it stays checkable

Signed at capture: your emitter signs each batch, and (SDK 0.2.0 and later) every record in it, before anything leaves your side.
Rooted daily: each closed day gets a Merkle root, and rooted days refuse new records.
Signed on export: Provantix signs the export manifest, checked against keys we publish.
Committed in public: daily roots and export manifest hashes are logged in a public transparency log that anyone can mirror to catch a rewrite.

Check it yourself

You do not need an account. Upload an export to the in-browser verifier, or run the standalone verifier from the kit on a copy. A pass says what it proves, and the same output says what it does not.

In your browser: nothing is uploaded, the files are read locally.
On your machine: Node 20 or Python 3, standard library only, no installs.
An independent second implementation and the format description, so you can build a third.

Honesty, up front

What the evidence proves, and what it does not

What it proves

A record was not changed, reordered or removed after it was signed and ingested.
Provantix issued exactly the export you hold.
Where your emitter seals its records and you hold its public key, your own emitter vouched for each one.

What it does not

That an agent reported everything it did. A sealed record proves what was sent, not that nothing was left out.
That the machine holding an emitter's key was uncompromised.
That an export will satisfy a particular audit. That is your auditor's judgement. We are not yet certified under SOC 2 or ISO 27001.

Trust: keys, custody and what we cannot do — Who holds which key, and the limits of the evidence.
The transparency log — How roots and manifests are committed to in public.
How verification works — The checks, in order.
Verify an export in your browser — No account.

Get an invite

Invite-only during early access. We check your email with a one-time code, then review your request and send the invite. Ask for a demo if you want one.