Evidence
What it proves — and what it does not
Everyone in this category promises an audit trail you can rely on completely. That promise is easy to make, impossible to check, and therefore worth nothing. Here is what our evidence actually establishes, what it cannot establish, and a verifier you can run yourself on this page.
Verify it here
Below is the real thing, not a recording. Every decision is computed by the policy engine as you watch; every ledger entry is a real hash. Select any entry and your browser recomputes the tree head from that entry's proof alone — if it matches, the entry is provably in the log and nothing before it was altered.
Every action, decided before it runs
…and written to evidence you can check
…Select an entry to recompute the head from its proof.
Nothing here is sent anywhere. The verification runs entirely in your browser, which is also the point: you do not have to trust our server to check our arithmetic.
What it proves
The record has not changed since it was logged
Any edit to any entry changes the tree head. You can check that yourself, below.
A specific record was in the log at a given size
An inclusion proof recomputes the head from one entry and its path — without revealing the others.
Between two published heads, nothing was removed — only appended
A consistency proof. Rewriting history becomes detectable rather than deniable.
What it does not prove
This is the more useful list. Anyone can tell you what their system proves; the limits are where you find out whether they understand it.
Not truth
A record saying an action was denied is recorded as faithfully as one saying it was allowed. The proof shows the record has not changed since it was written — not that it was accurate when written.
Not that the decision was right
That is a policy question. The evidence shows what was decided, not whether the policy was wise.
Not completeness
This is the one most people get wrong, including vendors who should know better. A Merkle log makes REWRITING history detectable. It does not make OMISSION detectable. If a record was never appended, no proof will say so.
Not identity beyond the key
Signature verification proves a specific key signed. Binding that key to us is a separate problem, which is what publication in an independent log is for.
Not third-party non-repudiation of the contents
Entries are metadata-first — hashes, names, counts. An auditor verifies structure, not your source. That is the deliberate privacy trade: your code never leaves your machine.
What is live today
The verifier on this page is real and running now. Publication of tree heads to an independent transparency log — so that our own key is not the root of trust — is specified and not yet deployed. We will say so here on the day it changes, and not before.
A page about evidence that overstated its own status would refute itself. If you are evaluating us, that sentence is the one to hold us to.
Why metadata-first
Entries record which agent, which action, which resource, which decision and which rule — never your source code. Grading and authorization read agent configuration and capability boundaries; your code stays on your machine. That limits what an auditor can independently confirm, and we would rather accept that limit than ask you to upload your codebase.
The scoring behind any grade is published separately — see the methodology.