12
An Agent You Can Audit
A hash-chained audit log, personal data redacted before any model call, and a policy the model cannot overrule.
What it measured
All 18 red-team invoices in the test split end in their required outcome. No personal data appears in anything the runs store, and every audit chain verifies.
Measured 2026-10-12 · the source is private, so this cannot be checked yet
Done when
A reader can clone the repository, change one audit record, and watch verification fail. The source is public.
Each step the agent takes is written to an append-only log. Every entry carries the hash of the one before it, and the head of the chain is pushed to a separate repository, so an edit anywhere breaks verification.
Personal data is replaced with tokens before a request leaves the machine. A tripwire then checks the outgoing request again and stops the run if any personal data survived. A scanned PDF cannot be redacted, so it is never sent at all: it goes to two approvers instead.
The red-team set tries what a hostile supplier would try. Invoices ask for payment to a new account, carry instructions addressed to the agent, or split an amount to stay under the approval limit. The first scoring run caught 17 of 18. The miss was a split invoice: the company’s two earlier invoices sat under its second vendor record, so the split rule never saw them. Now every record at one address with a close name counts as one company, and the re-run caught all 18.