The audit ledger: evidence as a side effect
Jan 24, 2026 · 7 min read
Reconstructing what an AI system did from scattered logs after an incident is a losing game. Make the evidence a byproduct of enforcement instead.
The worst time to discover your logging was insufficient is during an incident review. Yet that's the default posture for most AI deployments: enforcement happens somewhere, logging happens somewhere else, and the two are stitched together under pressure when a regulator asks what happened.
We took the opposite approach. Every adjudicated decision writes an append-only, hash-chained record at the moment it's made. The reason a request was blocked, the policy version that decided it, the principal, the finding - all captured as a side effect of enforcement, not a parallel system you hope stayed in sync.
Hash-chaining matters because evidence that can be edited isn't evidence. Each record commits to the one before it, so any tampering breaks the chain and is detectable. An auditor can verify the ledger independently rather than trusting that nobody touched the logs.
Evidence as a side effect changes the economics of compliance. You stop building a separate reporting pipeline and start querying the record you already have.
Further reading