Applications · Audit
Auditing what an AI agent actually did.
An agent that places orders, moves money, and rewrites records leaves its account of itself in the systems of the company being audited. Application logs are writable by whoever runs them, so testing them establishes housekeeping rather than fact — and sampling a period only tells you about what was still there to sample.
What follows is the sequence an auditor should run themselves rather than accept the output of. Each step names the artifact it produces.
The audited party cannot author it alone
Receipts are signed inside hardware whose key has no path out, batched, and anchored daily on a public chain. Verification reads that anchor from an endpoint of the auditor's choosing, so nothing rests on a key file the audited company supplied.
Authority, as it stood at the time
Who activated an agent, which tools it was granted, who approved a widening, and when — kept in an append-only register with its own timestamps. Individual action receipts cannot answer this, and reconstructing it after the fact is guesswork.
Refusals are on the record
A blocked action is signed with its grounds. A control that only logs what it permitted gives an auditor no way to show it ever stopped anything, which is the half of the test that matters.
From a journal line back to the receipt
A figure in the accounting projection traces to the signed receipt for the action that produced it, and the exposure a period is billed on reconciles to the same receipts — an omitted row does not balance.
The evidence pack
Five steps, in the order that makes the rest mean anything.
EXPORT
Take the period from the gateway
Receipts, batches, keys, approvals, grants, and the exposure projection for the period. The gateway belongs to the audited company — which is the problem every step after this one exists to solve.
BIND
Tie it to something they did not write
Check the batch roots against the on-chain anchor, through an RPC endpoint that is not theirs. Skip this and every figure below is worthless: a fabricated bundle passes every internally-consistent check there is.
WITNESS
Keep your own record of the quiet
A period with no receipts is either a period with no activity or a gateway that was down, and the export cannot tell them apart. Availability is polled independently, on a schedule the audited party does not control.
COMPARE
Test for what was removed
Three registers — receipts, grants, and losses — are hash-chained, so a deletion breaks the chain where it happened. Compared against heads published earlier, a log restarted with rewritten history stops matching.
READ
Every figure labelled with what it rests on
Read against objectives agreed before the period began, with each number carrying its own provenance, so a discussion is about the control rather than about whose spreadsheet to believe.
Said plainly: a product cannot be certified. ISO/IEC 27001 certifies an organisation's management system and a SOC 2 report is an auditor's opinion about a service organisation over a stated period, and neither is inherited by installing something. What this produces is the evidence a certified organisation would otherwise assemble by hand, mapped control by control, with partial coverage recorded as partial. The system has had no independent audit of its own.
Get in touch
[email protected]→