Research · Paper
A record a stranger can check: designing an audit trail for agents
An audit trail is only as good as the trust it requires. If checking it means asking the vendor, it proves little. This paper describes the record elan1 Govern writes for every action, and why it is built so an auditor can verify it offline, with one command.
- Author
- elan1 research team · Research
- Published
- Reading time
- 3 min read
What an auditor actually needs
When an auditor reviews a change made by an agent, they ask the same questions they ask of a person. What was requested? What was checked? Who decided, and on what basis? What changed as a result? And can I be sure this record has not been altered since?
Most AI systems answer the first questions with application logs, and the last one with a promise. Logs can be edited, rotated or lost, and a vendor's word is not evidence.
The record, field by field
elan1 Govern writes a record of 16 fields for every action, whether it was allowed, approved or refused. They group into four questions:
- What was asked: the agent's verified identity, the action type, the target system and the full request.
- What was checked: the rules evaluated, their versions and the result of each.
- Who decided: the outcome, and for an approval the named person, their answer and the time.
- What happened: what ran, the response from the system of record, and the link to the previous record.
Chaining, not just storing
Each record carries a cryptographic hash of the one before it, forming a chain. Changing any past record breaks every link after it. Records are signed, so it is also possible to show which system wrote them.
None of this is new cryptography. It is the same idea that makes a bound, page-numbered ledger more trustworthy than loose sheets. What matters is applying it to every agent action, including refusals, so the gaps are as visible as the entries.
Verification without trust
An auditor can verify an elan1 Govern record offline, with one command, without trusting elan1. The open verifier recomputes the chain and checks the signatures, and reports whether the chain is intact. If elan1 ceased to exist tomorrow, the records and the means to check them would still be yours.
How it fits the rules
Several regimes ask for this kind of evidence. The MCA audit-trail rule requires an edit log in accounting software that cannot be disabled. RBI's draft model-risk guidance proposes 10-year retention for model records. The EU AI Act asks for automatic logging for high-risk systems, and ISO/IEC 42001 expects documented evidence of AI controls. A record that a stranger can check is the common denominator.
Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval.
Key takeaways
- An agent's record must answer what was asked, what was checked, who decided and what happened.
- Hash-chained, signed records make tampering visible; including refusals makes gaps visible too.
- Offline verification means the record stays checkable without trusting, or even contacting, the vendor.
Further reading
Product capabilities named here carry their current status (available, in pilot or designed) on each product page and in Trust and security. Figures marked “Design target” are specifications, not measurements.
About the author
elan1 research team
Research
The research team writes elan1's papers and briefs. Each one states its method and its limits, labels design targets as targets, and cites third-party figures to their primary source. elan1 has no customer results to publish yet, and our research does not imply any.
