An AI agent audit trail anyone can verify offline.
An AI agent audit trail is a record of the decisions made about an agent’s actions, kept so that someone else can check them later. Praesidia records the decisions it makes in an append-only, hash-chained audit trail, signed under the default configuration; an operator can turn signing off. Your auditor checks an exported bundle on their own machine, offline, without trusting us.
Signed bills of materials, trust passports and the signed audit trail are in every plan, including the free Developer plan. No credit card required.
- When
- 14 Sep 2026, 10:42:07 UTC
- Agent
- Invoice agent
- Wanted to
- Refund €8,250 to customer C-1182 through the payments MCP server
- Rule
- Refunds above €5,000 need a finance approver
- Decision
- Held for approval · 10:42 Approved by finance lead · 10:44
signed 7f3a 91c0 … c21e
follows no. 000411 a90d … 4b07
Illustrative, with invented data. A Decision Receipt carries one decision’s agent, authorization result, policy version, evidence hash and signature status. A hold applies once a policy is set to enforce; approving a held call is in every plan.
Can your auditor check what an agent did last Tuesday, without logging in to anyone’s console, including ours?
A dashboard can tell you an agent was governed. Praesidia hands you the record: what the agent asked to do, which rule decided it, who approved it, and a signature and chain that stop checking out if anyone changes a single line afterwards.
- Decision Receipt
- One policy decision, read back as a receipt: the agent, the authorization result, the policy version, the evidence hash, and whether the record is signed and anchored. List them by AI system, agent, action or time range. In every plan.
- Hash and signature
- The audit trail is hash-chained and signed under the default configuration, so a record that was added, altered or removed afterwards no longer checks out, except that removing the newest records is detectable only with external anchoring, which is optional.
- Audit package
- One export for a chosen period: a summary to read, and the signed evidence bundle inside it that your auditor checks. What it contains.
- Target receipts
- For a registered target that signs its own receipt, the evidence includes the target’s signed account of the exact request and its result, not only ours. Advanced
- Evidence grades
- Each protected action is graded by who vouches for it. Advanced, enabled per organization
- A — the target signed a receipt you can check without trusting Praesidia.
- B — an edge you control saw the exact request and response, with the destination confirmed.
- C — Praesidia’s managed route recorded the dispatch and the response. Actions through the managed MCP route reach C at most.
- D — the application’s own report, best effort.
- AIBOM and Trust Passport
- A signed bill of materials per AI system, and a passport you can publish; both below, as Exhibits A and B.
- Offline verifier
- Checks a bundle on your auditor’s machine without calling us. Handed to you directly, not a public download yet; how it works.
Evidence you can hand over, not screenshots of a dashboard
Each exhibit is something Praesidia produces for you, signed, so the person receiving it can tell nothing was changed after it left your hands.
A signed bill of materials for every AI system
Models, tools, data sources and policies, versioned on every change. Export it as CycloneDX, compare two releases line by line, and verify it offline. A new model or data source reopens the system’s review on its own.
Review reopened: substantial change · CycloneDX · Signed snapshot
A trust passport your customers can check
Publish a page, a badge and a PDF for each AI system, rooted in its evidence. When a vendor sends you theirs, import it and verify it against the key you pinned, before their agent touches your data.
- Published by
- Acme Finance
- Bill of materials
- Version 15, signed
- Last evaluation
- Passed, 12 Sep 2026
- Evidence root
- 3c9e 0b12 … 77fa
Verified passport
An incident file, opened for you
Related signals become one incident with a response timeline and a signed evidence bundle, with the report a regulator asks for after a serious incident drafted from it. Each incident proposes the control that stops a repeat: one click to accept, one to undo.
The record itself, before anyone checks it
Praesidia records the decisions it makes in an append-only, hash-chained audit trail, signed under the default configuration; an operator can turn signing off. Each row names the action, who took it, when, and the payload it carried: the rows a signed export is built from.
Counted, not claimed
Numbers you can check against the product, not against a customer we can’t name.
Counted in the product, September 2026.
Don’t take our word for it. Check the record.
The audit trail is hash-chained and signed under the default configuration, so you can check an exported bundle without calling us. External anchoring is optional; without it, removal of the most recent records cannot be detected.
- 1
Export a signed bundle. Organization owners and compliance officers export any range up to 90 days. The export is itself recorded.
- 2
Hand it to whoever needs to check. Your team, your auditor, a regulator, together with our Apache-2.0 offline verifier, which we give you directly.
- 3
They check it on their own machine. Offline, without calling us. Valid, invalid or incomplete, with an exit code a script can act on, never a silent pass.
$ praesidia-verify finance-2026-q3.zip
manifest valid 1 checked
row signatures valid 412 checked
chain integrity valid 412 checked
root signatures valid 3 checked
rekor receipts valid 3 checked
platform attest. valid 1 checked
RESULT: OK exit 0Receipts from the public Rekor log appear when external anchoring is on.
Read the verification guide: from an agent action to verified evidence.
What the proof shows, and what it does not
A seal is only worth what you know about its limits. A signed record shows it was not changed afterwards. It does not show that every action was captured. These are the short versions; the full list is on verify your audit trail.
- Nothing was changed. No record in a bundle was added, altered or removed after it was signed.
- The chain is whole. The records in the bundle form one unbroken hash chain.
- Who signed it. Every record is signed by a key in the bundle’s signed key set, and that key was not revoked.
- An outside witness, when you want one. With external anchoring on, each hash root has a receipt in a public log we cannot rewrite.
- That every action was captured. Calls that do not pass through Praesidia are not recorded.
- That the newest records are all there. External anchoring is optional; without it, removal of the most recent records cannot be detected. Even with anchoring on, records written since the most recent anchor are not yet covered.
- That anchoring was on. Read the anchoring line; an overall pass does not imply it.
- Certification. Framework mappings are not certifications, and a passport reports posture rather than guaranteeing it.
New policies start in observe mode: decisions are recorded, nothing is blocked. Denials and holds apply once a policy is set to enforce. Approving a held call is in every plan; multi-step approval workflows are Enterprise. Framework mappings are not certifications. Records and figures marked Illustrative show the real shape with invented data.
Read next: the AI agent audit trail guide · evidence and audit · incident response · Trust Center · compliance mappings · the whole platform
Common questions about the AI agent audit trail
A record of the decisions made about an agent's actions, kept so that someone else can check them later. Praesidia keeps one for the decisions it makes on the calls that pass through it, and you can export it as a signed bundle.
Yes. Hand them an exported bundle together with our Apache-2.0 offline verifier. It runs on their own machine without calling us and reports valid, invalid or incomplete, with an exit code a script can act on.
That no record in the bundle was changed after it was signed, that the records form one unbroken hash chain, and which key signed them. A signed record shows it was not changed afterwards. It does not show that every action was captured.
An outside witness. With anchoring on, each hash root has a receipt in the public Sigstore Rekor log, which we cannot rewrite. External anchoring is optional; without it, removal of the most recent records cannot be detected.
Every plan, including the free Developer plan.
Go deeper
- The AI agent audit trail guide — what a trail should hold and how to judge one.
- Tamper-evident audit logs — hash chains, signatures and anchoring, explained.
- How to audit AI agent activity — a working method for reviewers.
- Post-incident forensics for AI agents — reconstructing what happened from the record.
- SOC 2 controls for AI agents — where an audit trail fits the criteria.
- AI agent audit trail, defined in the glossary.
Start with one agent. Keep every receipt.
Pricing is public. No credit card required.