Evidence
Know exactly what happened — and why.
Every action Guard evaluates leaves a receipt: the decision, the rule it matched, who approved it, and a signed record you can replay. One answer per action, not a log to correlate.
What each receipt contains
Decision
Every allow, approve, and block is a receipt. The rule that fired and the reason string are embedded — not inferred from logs.
Approval
When Guard routes an action to human approval, the receipt records who approved it, when, and on what grounds. Full approval chain preserved.
Execution
After the action executes, the outcome is appended to the same receipt. One record from policy decision through execution result.
Integrity
Receipts are SHA-256 hash-chained. Alter any record and the chain breaks at verification. Verify on demand via the Guard API.
Retention
Stored per workspace with configurable retention. Export by time window, agent, policy, or decision type — set in Guard configuration, not separately.
Reference
Timestamp tied to canonical reference date. Every receipt is replayable — reconstruct any agent decision after the fact.
Compliance mapping
Guard ships 15 compliance packs. When a pack rule fires, the receipt records which standard was enforced and which rule matched. Reports are generated from the audit trail — not from manual assertions.
+ 7 more packs. See Security Teams for the full list.
“Show me every block against payments this month.”
Lens is the workspace chat surface. Ask questions about Guard activity, compliance state, or any agent action — get answers backed by the audit trail, not log correlation.
Every block against payments · Sep 2026
Show me every block against payments this month
Every block against payments · Sep 2026
| Action | Decision | Count | Rule |
|---|---|---|---|
| process_refund | BLOCK | 12 | refund-cap-500 |
| issue_credit | BLOCK | 3 | credit-cap-1000 |
| deploy_production | APPROVE | 4 | prod-change-v4 |