Rows checked (24h)
18,373
sequence intact
Signatures valid
13,447
0 invalid · 0 unverifiable
Unchained rows
42
arrived outside the chain
Agents seen
3
3,678 tool calls · 1214 model calls
intact — the sequence
GET /v1/evidence/verify?period=24h 18,373 rows, hash-chained in order, none altered after they were written. Proves nobody edited history. Does not prove who wrote it.
signature_valid_rows — the author
same response 13,447 rows signed inside the process that acted, each chaining to the tenant's trust root. Proves authorship. The two are independent — a chain can be intact and unsigned, or signed and broken.
Recent rows
GET /v1/evidence?tenant_id=globex-azure&limit=12| Recorded | Event | Process | Service | Decision | Control | Signed |
|---|---|---|---|---|---|---|
| 00:15:44 | tool_call_allowed | …/interview-scorer/main/proc-2249218 | gcp_storage | allow | soc2 CC6.1 | |
| 00:15:35 | tool_call_allowed | …/resume-ranker/main/proc-2249111 | gcp_storage | allow | soc2 CC6.1 | |
| 00:15:26 | tool_call_denied | local-dev | gcp_storage | deny refused: this process has no identity | soc2 CC6.1 | |
| 00:14:29 | tool_call_allowed | …/interview-scorer/main/proc-2247011 | gcp_storage | allow | soc2 CC6.1 | |
| 00:14:24 | tool_call_allowed | …/resume-ranker/main/proc-2246903 | gcp_storage | allow | soc2 CC6.1 | |
| 00:14:20 | tool_call_denied | local-dev | gcp_storage | deny refused: this process has no identity | soc2 CC6.1 | |
| 00:13:20 | tool_call_allowed | …/interview-scorer/main/proc-2245942 | gcp_storage | allow | soc2 CC6.1 | |
| 00:13:11 | tool_call_allowed | …/resume-ranker/main/proc-2245866 | gcp_storage | allow | soc2 CC6.1 | |
| 00:13:09 | tool_call_denied | local-dev | gcp_storage | deny refused: this process has no identity | soc2 CC6.1 | |
| 00:12:10 | tool_call_allowed | …/interview-scorer/main/proc-2244837 | gcp_storage | allow | soc2 CC6.1 | |
| 00:12:07 | tool_call_allowed | …/resume-ranker/main/proc-2244708 | gcp_storage | allow | soc2 CC6.1 | |
| 00:11:59 | tool_call_denied | local-dev | gcp_storage | deny refused: this process has no identity | soc2 CC6.1 |
8 of 12 recent tool calls allowed. The refusal is the unregistered process asking for the same credential: it has no identity to sign with, so the row cannot be attributed — and that absence is the finding.