Regulated audit trails

Fix the method at decision time and hand auditors a bundle they check offline.

Who this is for

Companies under the EU AI Act, NIST AI RMF or sector rules, and the auditors who review them.

The problem

Audit logs kept by the company being audited can be rewritten. Anchoring each AI decision's inputs and outputs by hash in an outside, append-only log fixes the method at the time of the decision.

How it works

Each AI decision or output gets a record by hash: inputs, model, method version.
Records sit under a daily root the company cannot edit, with outside timestamps.
Auditors receive an export bundle and check it offline.

Routes it uses

POST /v1/records: append a signed record; the answer carries its digest and inclusion proof.
POST /v1/export: an offline bundle with proofs and timestamps for up to 100 records.
GET /v1/export/verify.mjs: the offline verifier an auditor runs on a bundle.

Set it up

Step 1. Choose what to anchor

Map each decision to a record: the output's hash as the artifact, input hashes in inputs, the model in model. See /guides/ai-act-nist for the field mapping.

Check: The mapping is written down and reviewed.

Step 2. Publish at decision time

Publish the record in the same transaction that commits the decision. Keep personal data out: hashes only.

BODY='{ ...record }'
SIG=$(printf %s "$BODY" | ./sign-ed25519)   # base64url signature over these exact bytes
curl -s -X POST 'https://aisourceoftruth.com/v1/records' \
  -H "Authorization: Bearer $AISOT_TOKEN" \
  -H "X-AISOT-Key-Id: $AISOT_KEY_ID" \
  -H "X-AISOT-Signature: $SIG" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/vnd.aisot.record+json' \
  --data-binary "$BODY"

Check: Every decision row has a record digest.

Step 3. Hand over a bundle

Export up to 100 records per bundle for the audit period.

curl -s -X POST 'https://aisourceoftruth.com/v1/export' \
  -H 'Content-Type: application/json' \
  --data '{"digests":["{digest}"]}'

Check: The bundle verifies offline.

Step 4. Give auditors the verifier

Auditors download verify.mjs and run it themselves.

curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/export/verify.mjs'

Check: An auditor reproduces the check without contacting you.

Publishing needs a publisher key and a token. The one-time setup is on /agents and in the plan's design.md.

Wire it into your agent

Publish from the service that commits decisions, inside its write path, with a retry queue so a registry outage delays the record instead of losing it.

MCP: add https://aisourceoftruth.com/mcp to the agent's MCP servers. Tools used: publish_record, export_bundle. Read tools need no token.

With the PromptReports products, or alone

CommitOps: CommitOps can tie a compliance commitment to the records that show it was met.
RepoOps: RepoOps records the agent sessions that changed the decision code, which an auditor can match to the method version.
Alone: every step above uses only AI Source of Truth.

Expected outcomes

Each decision has a record fixed at decision time.
Auditors check the trail offline without trusting your systems.

What it does not prove

Reference material, not legal advice. The record shows what you recorded and when, not that the decision was right.

The OpenSpec plan for your agent

Your coding agent fetches the plan and writes it into your repo as openspec/changes/integrate-aisot-audit-trail/:

curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/regulated-audit-trail/openspec?lang=python&with=commitops,repoops'

proposal.md: why, what changes in your product, impact.
design.md: where the calls sit in your agent, with code for each call.
tasks.md: checkable tasks, each step paired with a check against the live registry.
specs/audit-trail/spec.md: the requirements and scenarios.

Read it here: OpenSpec plan. Back to all use cases or the documentation library.

$ curl -H 'Accept: application/json' https://aisourceoftruth.com/use-cases/regulated-audit-trail # this page is a rendering of the API. Reproduce it as data.