Show auditors where each AI answer came from
Certant records the question, the passages it read, every step an agent took and who approved it, in a log nobody can edit.
- Asked by A. NgataDo casual staff get long service leave?
- ReadEnterprise agreement · clause 22.1 · page 63
- FlaggedHR handbook 2019 says ten years and has been replaced
- AnsweredSeven years of continuous service, with two citations
Prove an answer step by step
Most AI logs keep the prompt and the reply. When an answer is challenged, you also need the passages it read, which version of each document, and every step an agent took in between.
The EU AI Act asks for this. It requires high-risk systems to record events automatically and to keep those logs for at least six months.
- Sign-insWho, when, and through which identity provider
- Questions and answersThe question, the answer and the sources it cited
- Agent runsEvery step and every prompt, with each step's input and output
- Document ingestsWhat was loaded, and when
- Configuration changesWho changed a chatbot, agent or permission
Each entry carries the person, a timestamp and a digest of its content.
How to trace a challenged answer
Start from the person and the time, and work forward to the answer they received.
- Find the entry Look up the question by who asked it and when.
- Open the source Each citation opens the document at the paragraph the answer used.
- Walk the steps An agent run shows every step in order, with what went in and what came out.
- Check the approval An approved action runs exactly the plan the reviewer saw, without the agent planning it again.
Controls your auditor will ask about
The detail is on the security page, which you can read without an NDA, and we answer security questionnaires.
| Control | What Certant does |
|---|---|
| Append-only entries | Entries can't be changed once written, so tampering shows. |
| Retention | 365 days on Certant Cloud. On a sovereign deployment you set it to your auditor's horizon. |
| Streaming | Logs stream to S3, Splunk, Datadog or any S3-compatible store. |
| Identity | OIDC, SAML and SCIM, so every entry names a real person and leavers lose access the same day. |
| Versioned agents | Each agent release is versioned, and you can roll back to the last good one. |
Questions to settle before an audit
Can we audit every prompt, model response and agent decision?
Yes. Certant logs every query and agent run, and an agent run records each step and each prompt. The AI FDE also has an Audit tab showing every step a session took, including retries.
How long are AI audit logs kept?
For 365 days on Certant Cloud. On a sovereign deployment you choose the retention period.
Can the logs go to our SIEM?
Yes. They stream to S3, Splunk, Datadog or any S3-compatible destination you choose.
How do we show an AI action was approved?
Agents can pause at a human approval step. The approval is recorded with the action, and approving runs the exact plan the reviewer saw.
Bring your auditor's questions
Book a call and we'll walk through the audit log on your own documents, or start free and look at the log yourself.
At 10:42 UTC, A. Ngata exported the Q3 compliance report from Enterprise Agreement 2024.pdf.