Operations
Audit trail
Every call, whatever its outcome, is written to an append-only log. Records are chained together with SHA-256, so later changes are detectable.
What does an event contain?
| Field | Meaning |
|---|---|
timestamp | Event time. |
orgId, agentId, sessionId, correlationId | Who, which session, which call. |
tool, argsRedacted | The tool and its redacted arguments. |
policyVerdict, egressVerdict, ingressVerdict | Per-stage results. |
finalDecision, reason, ruleId | The final decision and its rationale. |
latencyMs, isShadow | Latency and shadow flag. |
prevHash, entryHash | The chain link. |
traceId, spanId | OpenTelemetry trace. |
How the chain works
Each record's entryHash is computed with SHA-256 over a canonical (key-sorted) JSON serialisation of all its security-relevant fields, and includes the previous record's hash.
Altering, deleting, inserting or re-ordering a record breaks the chain, and verification shows exactly which row is corrupted.
Verification and reporting
avertgate verify --db ./avertgate.sqlite
avertgate report --format markdown --output report.mdComplianceThe chained log makes later changes detectable. It is not a compliance certification in itself.
Redaction
The audit log stores arguments in redacted form. Only these redacted events go to the control plane.