Security & GovernanceSecurityWARDVOLTEvidence
How do you prove what your AI agent actually did?
Adam Cowles5 September 20264 min read
An AI agent changed something in production last night. Your security team has one question, and it is not what the model said. It is: can you prove what it did?
A log is not proof
Most teams can answer "what did the agent do" with a log. Logs are fine for debugging and useless for an argument. A log is a file your own systems wrote, that your own systems can rewrite, that an auditor, a regulator or an incident responder has no reason to trust on your word alone.
The moment an agent has real access to production, the question stops being operational and becomes evidential. Not "what do our logs say", but "what can we prove, to someone who does not trust us, about what happened, when, and who authorised it". That is a security question, and it is the one governance pitches usually skip.
What evidence actually requires
Evidence has three properties a log does not.
It is tamper-evident: if a record is changed after the fact, the change shows. It is complete on the actions it covers: a refused or blocked action is recorded exactly like a successful one, because "the agent tried and was denied" is often the line that matters most. And it is independently verifiable: someone outside your organisation can check it without asking you to vouch for it.
Those are not nice-to-haves for a security team. They are the difference between an audit finding and a clean report, and between an incident you can explain and one you cannot.
How Quox produces it
Every governed action an agent takes lands on a tamper-evident, hash-chained record as it happens. Each entry is linked to the one before it, so a single altered record breaks the chain, and the fields the hash is computed from are published, so you can recompute a receipt yourself and match it.
That is WARD, and it is the layer that turns "our logs say" into "here is a record you can check".
Those records roll up into the verifiable operations ledger, which exports as a portable evidence bundle: a self-contained file a third party can verify offline, without access to your systems and without trusting your infrastructure. The action, the actor, the time, and the proof travel together.
Governed execution is deny-by-default, and risky steps wait for a human in the approval inbox, so the record shows not just what ran, but what was refused and what a person signed off on.
The log a system writes vs the evidence a third party can check
| The question | A log | Witnessed evidence |
|---|---|---|
| Can it be edited after the fact? | Yes, silently | No, the change shows |
| Does it record refusals? | Sometimes | Yes, a refusal is evidence too |
| Can an outsider verify it? | Only on your word | Yes, offline, without trusting you |
| Does it survive an incident review? | Contested | It is the review |
What this changes for a security team
Incident response stops being archaeology. Instead of reconstructing what an agent probably did from scattered logs, you read a dated, signed record of what it actually did, and hand the same bundle to whoever needs to check it.
Audit and compliance stop being a scramble. The evidence for a control is not assembled after the fact from screenshots; it is produced as the work happens. This is the ground our security surface is built on: put agents to work with real access, and keep proof of everything they do that you can stand behind.
None of it asks anyone to trust Quox. That is the point.
The honest edge
Quox can prove what runs through it. It cannot attest to anything that happens outside it. A record proves that an action happened, when, and by whom, and that the record has not been silently changed; it does not prove anything about the world beyond the governed path.
That boundary is not a caveat buried at the bottom. It is what makes the rest credible. A vendor that claims to witness everything is telling you it witnesses nothing you can rely on. A vendor that tells you exactly where its evidence starts and stops is one you can actually take to an auditor.