Full interaction trace
Every step of a run, and how long it took
Agent, model and tool spans show what each run did, in Cortx dashboards for models, tools, sessions and cost.
Capability 06 · Observability & Audit
See what happened. Prove what was decided.
Cortx keeps two records of every agent run. Traces show what happened and how long each step took. A tamper-evident ledger records what was decided, refusals included, so infosec, model risk and auditors get evidence, not just logs.
Evidence and tracesWhat was decided, what happened, and whether the record still verifies.
Today
1,284Decisions recorded
37Refusals recorded
VerifiedLast checkpoint 14:00
From gateway, cluster and laptop to the people who check
Every enforcement point writes what it decided. Reviewers read it, export it and verify it without taking our word for it.
Who writes
Model and API gatewayEvery model call it decides on
Agent runtimeRuns, model calls and tool calls
MCP gatewayEvery tool call through it
SentinelCluster sensor, sandboxes and laptop device agent
Observability & Audit
Who reads
Infosec and model riskEvidence over a REST API
Your SIEMExports in OCSF, CEF or LEEF
AuditorsEvidence packs per control, board packs
Offline verificationA command-line tool, no Cortx access needed
Outside anchorsFile, S3 Object Lock or syslog
Telemetry may be lost.
Evidence may not.
Cortx keeps two planes. Spans answer what happened and how long it took. Ledger rows answer what was decided and whether anyone has edited it since. They are joined by ids, and neither stands in for the other.
Two planes, joined by ids
Agent spanstelemetry
Model spanstelemetry
Tool spanstelemetry
Decisionsevidence
Refusalsevidence
Containment actionsevidence
Four steps turn an agent run into evidence a reviewer can check. Select a step to jump to it.
01 · Trace
Agent, model and tool spans go to a self-hosted tracing backend. Best effort by design: spans drop under pressure, so tracing never slows the call it describes. They feed dashboards, cost attribution and evals.
02 · Record
Every governed decision appends a row to a hash chain, refusals included. If a record is lost, the loss is logged and reported, not hidden.
03 · Seal
For the core ledgers, a signed checkpoint pins the chain head every 1,000 rows or 15 minutes and is copied outside the database, to a file, S3 Object Lock or syslog.
04 · Answer
Reviewers read evidence over a REST API, export it for offline verification, and pull evidence packs per control, board packs and scheduled reports.
Two planes, never one
A span is never cited as evidence, and a ledger row is never sampled. They meet through ids carried on every evidence row.
- Spans what happened, how long
- Ledger rows what was decided
- Joined by trace, run and session ids
Logs tell you what ran.
Evidence proves what was decided.
Tamper-evident ledger
A record you can prove nobody edited
Decisions are written to hash chains, and the core ledgers are sealed by signed checkpoints kept outside the database, so a rewrite is detectable.
For reviewers
Answers for infosec, model risk and auditors
Reviewers pull evidence over a REST API, export to your SIEM in OCSF, CEF or LEEF, and verify signed checkpoints offline with a command-line tool.
Evidence your auditors
can sign off on
What is recorded, how it is protected, and what is signed today.
Refusals are recorded on purpose
A refusal leaves no span, no cost line and no work item, so Cortx writes it to the ledger deliberately, under one vocabulary.
A lost record is said, not hidden
If a decision's record can't be written, the decision still stands, and the loss is logged, counted and reported back to the caller.
A zero is not a clean bill of health
Attestations separate "observed safe" from "not exercised", so an empty result never reads as proof that nothing happened.
What is signed today
The containment ledger and the core estate chains are sealed by signed checkpoints and verifiable offline. Other audit records are hash-chained or plain audit tables; we'll show you which is which in your deployment.
See the evidence, not just the logs.
We'll trace one agent run, find its decisions on the ledger, and verify the checkpoint offline.