Guides  /  Governance and control

What evidence does an auditor actually ask for?

Answer

An auditor asks for the record of what the system did: the interaction, the control that applied to it, the authority it ran under, and proof the record has not changed since it was written. Completeness is the property under examination. A record covering some of the runs answers for those runs and leaves the rest undocumented.

Akka Verify writes a non-sampled, cryptographically hash-chained interaction log. Every event embeds the identity, the permissions and the policy bindings resolved at the moment the action executed.

The mechanism

Sampling is a cost control that removes the record.

Observability tools sample by design. Keeping one run in a hundred holds the storage bill down and preserves the shape of a latency distribution, which is what those tools report on.

An auditor examining one loan decision needs that decision. A sampled log holds it at whatever rate the sampler was configured for, and the gap cannot be filled afterwards, because the run has completed and the state it held is gone.

Akka captures every interaction into petabyte-scale storage, indexed and queryable, and the log is non-sampled by contract.

INSIDE THE RUNTIMEaction runsauthority resolvedidentity · permissions · policyevery event hashed with the one before itOUTSIDE THE REQUEST PATHa copy arrivessamplerkeeps a fractionthe runs the sampler dropped left no record
What the record carries

An evidence record covers the action, the control, the authority and the chain.

What the system didThe prompt, the response, and every tool call the agent proposed. The runtime gates each call, so the record distinguishes a call that executed from one a guardrail refused.
Which control appliedThe guardrail verdict, the policy that produced it, and the Eval Matrix row the policy answers to. An Eval Matrix is the signed list of safeguards a system must implement and demonstrate.
Who held the authorityThe workload identity of the service, the delegation chain from the person to the agent to any sub-agent to the tool, and the permissions in force at that moment.
That nothing changedEach event is cryptographically chained to the event before it. Removing or editing a record breaks the chain, and the break is visible to anyone recomputing it.
Retention

Each retention floor comes from the regulation that sets it.

EU AI Act Article 11 sets a ten-year floor for technical documentation. Article 26 sets a six-month floor for automatically generated logs. DORA requires five years or more for financial firms. A ninety-day window sold as a billing tier is shorter than every one of those.

Akka maps retention to those floors across explicit categories: the interaction log, trace tiers, Annex IV documentation, evidence exports, the held-execution archive, and the audit and change log. Legal hold is a first-class operation, so a record under hold survives the expiry its category would otherwise apply.

Questions

Related questions.

Is a trace the same as an evidence record?

A trace records timing and structure for an engineer debugging a request. An evidence record carries the decision, the authority behind it, and a chain that proves the record was not altered. Traces are sampled and can be edited after they are written.

Can this record be produced from outside the runtime?

The permissions and policy bindings in force at execution are visible to the runtime that propagated them. A component receiving a copy of the interaction afterwards receives the content without the authority it ran under.

What does an auditor do with a hash chain?

Recomputing the chain over an exported set shows whether any record was removed or changed, because each event carries a hash of the event before it. The check runs on the export the auditor holds.

Who can stop a record from expiring?

Legal hold is applied by the compliance owner and suspends retention expiry for the records it covers. A record under hold is retained until the hold is released.

Does the record cover agents built on other frameworks?

Evaluation and evidence capture work against agents built elsewhere. The authority snapshot requires the runtime to propagate identity through each call, which means the agent runs on Akka.

On Akka. The non-sampled interaction log, authority snapshots, retention categories and legal hold are capabilities of Akka Verify. Instruments named. The EU AI Act and DORA are public regulatory texts.