Platform · 04 · evidence
A record you can hand a CISO.
Not logs. A tamper-evident chain where every entry commits to the one before it, so six months later you can prove exactly what an agent did and under whose authority.
01 / the gap
Observability answers 'what happened'. Audit answers 'prove it'.
Tracing tools were built to help engineers debug. They sample, they expire, they are writable by the service that emits them, and they carry no notion of authority. Useful for a postmortem, worthless in front of a regulator.
An evidence record is a different artifact. It is complete rather than sampled, append-only rather than mutable, and it names the human behind every privileged action. It is the thing that lets a bank turn an agent on.
100%
of actions recorded
No sampling. Ever.
7y
default retention
Configurable, with legal hold.
02 / one entry
{
"seq": 4812,
"ts": "2026-09-20T09:14:27.481Z",
"session": "session/7f3a",
"principal": "agent:claims-bot",
"on_behalf_of": "user:mara@acme",
"ring": 1,
"tool": "stripe.refund",
"args": { "charge": "ch_3P…", "amount": 48200, "currency": "usd" },
"decision": "escalate",
"rule": "tools.stripe.refund.escalate",
"approval": {
"by": "user:mara@acme",
"at": "2026-09-20T09:15:02.118Z",
"method": "slack",
"signature": "ed25519:4f9c…81"
},
"result": { "status": 201, "id": "re_1Q…" },
"prev": "sha256:71ab04…9d",
"hash": "sha256:9c1e8a…f2"
}Each entry commits to its predecessor, so removing or editing one breaks every hash after it. Chain heads are published so you can prove a record existed at a point in time.
03 / what it gives you
- Attribution
- Every action names the agent, the human or service it acted for, and the delegation chain above it. No anonymous automation.
- Tamper evidence
- Hash-chained entries with periodic signed checkpoints. Deletion and mutation are detectable, not merely discouraged.
- Replay
- Step through a session as it happened — inputs, decisions, outputs — and diff two runs of the same task.
- Approvals
- The signed approval travels inside the record, so 'who authorised this' never requires a search through Slack history.
- Export
- Stream to Splunk, Datadog, S3, BigQuery, or Snowflake. Your retention, your storage, your queries.
- Redaction
- Field-level redaction with the hash preserved, so a secret can be removed without breaking the chain.
- Reports
- Per-agent and per-period summaries mapped to SOC 2 and ISO 27001 control language.
04 / verification
Verify it without asking us.
The verifier is open source and runs against an export. You do not have to trust our word that the chain is intact.
$ velone evidence export --session session/7f3a > run.jsonl
$ velone verify run.jsonl
4,812 entries
chain intact ✓
checkpoints valid ✓ (12 signed heads)
approvals verified ✓ (37 signatures)
redactions 3 (hashes preserved)05 / questions
Is this a blockchain?
No. It is a hash chain with signed checkpoints — the same primitive as certificate transparency or a Git history. There is no token, no consensus, and no distributed ledger, because none of those solve an audit problem inside one company.
Where is the data stored?
In your account by default. The control plane holds the chain heads for verification; the entries themselves can live entirely in storage you own, including on-premise object stores.
What about secrets in arguments?
Arguments are redacted by policy before they are written. The redaction preserves the hash of the original value, so you can prove what was passed without storing it.
Can we satisfy the EU AI Act with this?
It covers the record-keeping and traceability obligations for high-risk systems, which is the part most teams have no answer for. It is not a compliance programme on its own — our compliance page is explicit about what we do and do not cover.
keep reading
Ring 0
Make the agent's work provable.
If you cannot answer 'what did it do and who let it' in one query, you are not ready to scale agents. That is the gap we close first.