◆PROVOSTRY ← provostry.com

An audit trail for AI agents.

You deployed agents that write code, move money, or touch customer data. Someone is eventually going to ask who authorised a particular action and what they saw when they did. This page is about being able to answer that.

01 · The problem

Logs are not an audit trail

Most teams discover the gap during the first incident review. There are logs — gigabytes of them — and none of them answer the question being asked.

An audit trail has to survive three things that logs do not:

02 · What actually works

Append-only, attested by someone other than the actor

Two properties do most of the work, and they are the two that log aggregation cannot give you.

The record is appended, never edited

Every event — work submitted, evidence attached, escalation raised, decision made — is appended to a hash-chained ledger. Entries are added; nothing is rewritten. With a signing key set, each event is HMAC-signed, so tampering is detectable rather than merely against policy.

Nothing counts as done because the agent says so

Completed work is attested by CI, not by the agent that produced it. Synced commits stay unverified until CI attests them, and the velocity metric only moves on attested work. An agent cannot mark its own homework.

Human decisions are attributed to humans

Anything consequential raises an escalation that reaches a person in Slack, Teams, or Telegram. Approve or reject is recorded as a decision against the individual who clicked it — that attribution is the artifact you will need later.

The question an auditor actually asks is never "do you have logs?" It is "show me who approved this, and what they were looking at." Those are different data structures.

03 · What this is

The audit trail is a consequence, not a feature

You can bolt a ledger onto an agent stack and get something that looks like an audit trail. It fails the moment the interesting question arrives, because the record was still assembled from self-reported claims.

What produces a trail worth trusting is the surrounding system: budgets that raise an escalation instead of quietly overspending, validation that ratchets so a caught regression stays caught, and independent attestation standing between "the agent finished" and "the work is done." Provostry is that system — an operating system for AI organizations. The audit trail is what falls out of running one.

That is also why it self-hosts cleanly: teams who need this most often cannot let the ledger leave their network. Single container, file ledger or Postgres, fully air-gapped, no phone-home.

04 · Questions

Common questions

What is an audit trail for AI agents?
A durable record of what each agent did, what evidence supported it, and which human approved anything consequential — kept somewhere the agents themselves cannot rewrite.
Why aren't logs enough?
Logs answer "what happened." An audit answers "who is accountable, and what did they see when they decided." Logs are also mutable and self-reported.
How do you prove the work was actually verified?
By requiring attestation from something other than the agent that did it. CI attests; the agent does not get a vote.
Does the record survive someone wanting it gone?
The ledger is append-only and hash-chained. With a signing key, every event is signed and tampering becomes detectable.

05 · Try it

See it on your own agents

Wire an agent in with one HTTP call and watch the first evidence bundle land in the ledger. No sales call in the way.

Read the integration docs →

Or see what self-hosting involves.