A record a stranger can check: designing an audit trail for agents

What an auditor actually needs

When an auditor reviews a change made by an agent, they ask the same questions they ask of a person. What was requested? What was checked? Who decided, and on what basis? What changed as a result? And can I be sure this record has not been altered since?

Most AI systems answer the first questions with application logs, and the last one with a promise. Logs can be edited, rotated or lost, and a vendor's word is not evidence.

The record, field by field

elan1 Govern writes a record of 16 fields for every action, whether it was allowed, approved or refused. They group into four questions:

• What was asked: the agent's verified identity, the action type, the target system and the full request.
• What was checked: the rules evaluated, their versions and the result of each.
• Who decided: the outcome, and for an approval the named person, their answer and the time.
• What happened: what ran, the response from the system of record, and the link to the previous record.

Chaining, not just storing

Each record carries a cryptographic hash of the one before it, forming a chain. Changing any past record breaks every link after it. Records are signed, so it is also possible to show which system wrote them.

None of this is new cryptography. It is the same idea that makes a bound, page-numbered ledger more trustworthy than loose sheets. What matters is applying it to every agent action, including refusals, so the gaps are as visible as the entries.

Verification without trust

An auditor can verify an elan1 Govern record offline, with one command, without trusting elan1. The open verifier recomputes the chain and checks the signatures, and reports whether the chain is intact. If elan1 ceased to exist tomorrow, the records and the means to check them would still be yours.

How it fits the rules

Several regimes ask for this kind of evidence. The MCA audit-trail rule requires an edit log in accounting software that cannot be disabled. RBI's draft model-risk guidance proposes 10-year retention for model records. The EU AI Act asks for automatic logging for high-risk systems, and ISO/IEC 42001 expects documented evidence of AI controls. A record that a stranger can check is the common denominator.

Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval.