Evidence
Know exactly what happened — and why.
Every action Guard evaluates leaves a receipt: the decision, the rule it matched, who approved it, and a signed record you can replay. One answer per action, not a log to correlate.
What each receipt contains
- Decision (allow / approve / block) and the rule that fired
- The agent, user, resource, and action attempted
- Approval chain if human review was required
- Execution outcome and any downstream effects
- Integrity marker — SHA-256 hash chain so tampering is detectable
- Reference timestamp tied to the canonical reference date
What you can do with it
- Answer a regulator or auditor with a signed record
- Reconstruct any agent decision after the fact
- Map decisions to compliance controls (SOC 2, HIPAA, PCI DSS, EU AI Act)
- Retain and export by policy, not by log volume
- Verify chain integrity via the Guard verification API
Decision
Every allow, approve, and block is a receipt. The decision is not inferred from logs — it is the primary record. The rule that fired and the reason string are embedded.
Approval
When Guard routes an action to human approval, the receipt records who approved it, when they approved it, and on what grounds. The full approval chain is part of the receipt.
Execution
After the action executes, the outcome is appended to the same receipt. One record from policy decision through to execution result.
Integrity
Receipts are SHA-256 hash-chained. Each entry includes the hash of the previous entry. Alter any record and the chain breaks at verification. The integrity endpoint lets you verify the full chain on demand.
Guard verification API — get_verify_evidence
Retention
Receipts are stored per workspace with configurable retention. Export by time window, agent, policy, or decision type. Retention policy is set in Guard configuration — not in the audit system separately.
Compliance mapping
Guard ships 15 compliance packs. Each pack maps rules to a compliance standard. When a pack rule fires, the receipt records which standard was enforced and which rule matched. Compliance reports are generated from the audit trail — not from manual assertions.
+ 5 more packs. See Security Teams for the full list.
Lens
“Ask Lens: ‘show me every block against payments-api this month.’”
Lens is the workspace chat surface. Ask questions about Guard activity, compliance state, or any agent action — and get answers backed by the audit trail, not log correlation.