EVIDENCE

Evidence is not logs

Ordinary logs describe activity after it happens. Stipul produces tamper-evident audit evidence during runtime authorization of mediated AI agent tool calls. Not after the fact. During enforcement. Writ evaluates whether a mediated tool call is allowed or denied, Chronicle records the enforcement decision, and Seal verifies whether the recorded evidence chain remains intact.

Logs describe. Evidence verifies.

LOGS

Logs can be useful for debugging, operations, and investigation. But a log line usually says that something was written down. It may not prove that the record is complete, that nothing was removed, or that the entry is tied to a runtime authorization decision.

STIPUL EVIDENCE

Stipul evidence is created at the enforcement point for each mediated call routed through Writ. Chronicle records the requested tool, the Charter rule applied, the allow or deny decision, forwarding status, timestamp, and session context. Seal verifies whether the recorded evidence chain remains intact.

What Chronicle records for each mediated authorization decision

Every mediated enforcement decision records:

  • Tool requested
  • Charter rule applied
  • Decision: ALLOW or DENY
  • Forwarding status
  • Timestamp
  • Session context
  • Policy-relevant parameters subject to redaction

Chronicle records enforcement decisions and policy-relevant parameters. It should not store full API response bodies, credentials, tokens, secrets, or sensitive third-party payloads.

What the Seal binds: cryptographic attestation for Stipul sessions

When a session closes, Seal binds the session ID, Charter fingerprint, and Chronicle hash to a cryptographic attestation. The attestation covers the complete hash-linked decision sequence from session open to session close. It is not a signature on a single event. It is verification over the recorded authorization session.

What verification proves

Verification answers two questions:

Is the Seal valid? Does the cryptographic attestation match the Chronicle as it exists now?

Is the Chronicle intact? Is the hash chain unbroken from the first event to the last?

VERIFIED

Trust: VERIFIED. Seal: VALID. The recorded evidence chain has not been modified since the session closed.

REJECTED

Trust: REJECTED. Something changed.

What verification does not prove

Verification does not prove the Charter was correct. A bad policy enforced perfectly can still produce a valid Seal.

Verification does not prove the agent behaved well. An agent that only requested denied actions can still produce a valid Chronicle.

Verification does not prove actions outside the governed workflow did not occur. Stipul records decisions for mediated calls routed through Writ.

Verification does not prove origin in the full enterprise sense. The current trust model proves integrity of the recorded evidence chain, not that a specific enterprise identity produced the record. Stronger origin binding, credential custody, and enterprise attestation are roadmap items.

Why denied and not forwarded is stronger than denied and logged

When Stipul denies a mediated call, the claim is not just "we said no." The claim is that Writ did not forward the denied call to the third-party system through the governed enforcement path. The action was stopped before execution.

This is different from logging a denial and forwarding anyway. It is different from alerting after the call already fired. In the Writ path, the enforcement decision and the evidence record are produced as part of the same mediated execution flow.

Logging vs. Stipul evidence

LOGGING

Something happened. We wrote it down.

STIPUL EVIDENCE

A mediated action was allowed or denied before execution. The decision was recorded when it happened. The evidence chain was hash-linked, sealed, and can be verified.