Six things a log cannot do
Evidence has to survive a question asked months later by someone who does not trust the system that produced it. That is a different design goal from observability.
One request, one linked record
The unit of evidence is not a log line. It is a record that connects the caller, the decision, the rule that produced it, what was removed, where it went, and what it touched. Everything else on this page is a view over that record.
Every model call, with the decision that shaped it
The LLM audit is queryable by project, agent, model, provider, region, decision and date. A reviewer filters to the population they care about and reads the decisions, not the payloads. Only the redacted text is kept, so the audit itself does not become the largest concentration of personal data you own. Raw-audit projects are the deliberate exception, and are labelled as such.
What the agent tried to do, not only what it said
A model call is speech. A tool call is an action against a real system, and it is the part an auditor cares about. Every tool invocation is recorded with the server, the action, the permission that allowed or denied it, and the shape of the arguments. Attempted actions are kept, not only successful ones.
One task is not one request
A single instruction becomes a dozen model turns and tool calls, often across several agents. Read as flat log lines, that is unintelligible. The call-chain graph keeps the parent and child relationships, so a reviewer can follow one task from the instruction to the last action and see exactly where a control fired.
Evidence nobody can quietly edit, including us
An audit trail that an administrator can rewrite is not evidence, it is a report. Records are append-only and hash-chained in segments, verification runs on a schedule, and the current integrity state is visible to your auditor role rather than asserted in a PDF.
Prove minimisation without keeping the personal data
The uncomfortable part of proving redaction is that the proof usually requires keeping what you redacted. obstruo records the standard that applied, the categories detected, how many entities were replaced and what happened on failure. Counts, categories and the tokenized text, never the original values.
The block is the start of the record, not the end of it
When a guardrail fires or an agent reaches for something it was not given, an incident opens with the request that caused it already attached. Compliance works it from there: severity, owner, the policy involved, the action taken, and the policy change that closed it. Nothing is reconstructed from provider dashboards a week later.
Keep evidence longer than you keep data
Storage minimisation and audit obligations pull in opposite directions. They only reconcile if the two things have separate lifetimes. Metadata records can be kept for years because they hold no personal data, while redacted content expires quickly, per class and per project.
Nothing new reaches a project without a name on it
Before a new model or MCP server becomes available to a project, someone in compliance approves it. The request carries the reason, the requester and the approver, and the decision is recorded against the model or server it unlocked. Months later, any record produced under that decision points back to it.
Map the control once, answer every framework
Frameworks overlap heavily. The same redaction control satisfies a GDPR clause, an ISO control and a SOC 2 criterion, and answers half a customer questionnaire. Mapping lives on the control, so evidence inherits it instead of being re-mapped by hand each cycle.
An export, not a project
The point of all of this is the moment an auditor or an enterprise buyer asks a question. Scope a pack by project, agent, framework or date range and it comes out with the control state, the counts, the exceptions and the integrity proof, in a form you can hand to someone outside your organisation.
Evidence is a by-product. The policies, registries and redaction standards that generate it live on the governance page, and the enforcement that produces each decision is on runtime controls.