Ethosure is…
The deterministic control point and independently verifiable evidence layer for AI coding agents in regulated enterprises.
What the audit log is
Every change to the governance surface writes a row. Policy edits, cost-policy tuning, coefficient recalibration, agent onboarding, HMAC key rotation, ingest breaker events, redaction spot-checks, override decisions with reviewer notes, signed compliance exports. Every row carries who did it, when, what changed, and a structured payload a reviewer can open on the same page. Actors are named (governance owner, reviewer, on-call, automated system) rather than collapsed into a generic “admin.”
What it does not contain
No prompts, no tool commands, no diff bodies, no customer data. That separation is deliberate. The audit ledger proves who governed the fleet. The fact table proves what the fleet did. Neither one carries the payloads that would make it a compliance liability of its own.
Most AI observability tools log model calls and call it governance. Datadog LLM Observability, LangSmith, Arize, WhyLabs all capture traces, tokens, and latencies. That answers “what did the model do.” It does not answer “who authorised the guardrail that let it do that, on what evidence, and with which reviewer signing off.”
Purpose-built governance tools that do log operator actions (Credo AI, Fiddler, Robust Intelligence) tend to sit above the runtime, so their audit is administrative: policy library edits, workflow approvals, model registrations. They do not capture the runtime enforcement decisions the same trail. Ethosure records both in one ledger: the policy edit and the enforcement decisions that flowed from it, side by side, so a reviewer can trace cause to effect in one query.
Three design choices set it apart.
- First, every row is signed at ingest with HMAC-SHA256, so tamper attempts show up as an unsigned or invalid row on the Settings page.
- Second, the compliance export bundles the audit trail plus the policy bundle plus every reviewer decision into a signed .zip a regulator can verify offline.
- Third, override decisions require a reviewer note that goes to the ledger. There is no silent override.
Why it benefits the organization
- Regulatory defensibility. EU AI Act Article 12 requires automatic recording of events over the system’s lifetime. NIST AI RMF calls for provenance of governance decisions. SR 11-7 and OSFI E-23 want documented model risk controls. This ledger produces the exhibit those frameworks ask for, in the shape they ask for it, without a data science team having to reconstruct history from notebooks.
- Faster incident review. When an AI agent misbehaves, the first question is always “was this a policy failure, an override, or a model drift.” The audit trail resolves it in one query: policy state at the time, decisions that ran through it, reviewer notes on any overrides. Post-mortems that used to take a week take an afternoon.
- Board and audit-committee comfort. The signed compliance bundle is a repeatable artefact the risk committee can review quarterly. It is the same document internal audit, an external auditor, or a regulator would receive. One source of truth reduces the surface area for surprises.
- Change-management discipline. Because every operator action is named, timestamped, and reviewer-attributed, the team stops treating governance as tribal knowledge. The ledger is the runbook.
Ethosure logs the governance itself, not just the model calls, and delivers the signed evidence a regulator, auditor, or board asks for without a compliance team having to assemble it.
