The console shows evidence from your workspace. It does not make a compliance determination or issue a certification. Each control lists what the console observed and, separately, the obligations outside the platform that need their own evidence.
Controls
The catalog maps 19 controls across four frameworks to checks on your workspace’s own data.
Each control is judged from one or more checks, and each check states its criterion. A check passes, fails, or cannot be judged because there is nothing to judge.
Each check is labelled with where its evidence came from: observed (the console saw it), computed (the console derived it) or agent reported (the agent’s own claim). Expand a control to see what the platform evidences, what lies outside the platform, and how to fix a failing check.
Controls are judged on the last 30, 90 (the default), 180 or 365 days, but never further back than the workspace keeps events. Re-evaluate runs them again. The Enforcement card shows each agent’s mode (enforce, observe or not reported) as its latest ended session reported it.
Policies
Policies live in each agent’s library: the governance layer’spolicy_set, enterprise-default unless you set another. The console reports which policy sets were evaluated and which rules triggered, with each decision (deny, require approval, conditional, allow). It never changes a policy. Built-in sets are labelled with the library version they came from; anything else is labelled custom.
Enforcement belongs to the agent. In enforce mode a deny blocks the tool call, and a require approval holds it for an approval handler. See Escalation and approval.
Evidence report
The Evidence report tab produces a signed record of the controls for an auditor or reviewer: the same evaluation as the Controls tab, plus the evidence it was judged on, signed with the workspace’s attestation key.- Download signed evidence (JSON) saves
agentegrity-evidence-<workspace>-<date>.json. - Print report opens a printable version with Download JSON and Print / Save as PDF. Each time that page loads, a new report is generated and signed.
- Verify chains now walks the attestation chain, and for admins the audit chain too, and shows the latest result for each.
compliance.report.generate. The attestation chain is cited from its last verification.
The file holds report, signature and a verification note. Verify it like a certificate (see Verify a certificate): the fingerprint is the SHA-256 of report without fingerprint_sha256, and the hex Ed25519 signature in signature.value covers the whole report. In the certificate script, replace the two lines that read the file with:
Audit log
The audit log records administrative actions in the workspace. Admins open it from Audit log in the sidebar, the Governance tab or the Settings tab of the same name. Other members see “Admins only”.
Each entry records the time, the actor (a user or the system), the action, its target, details and the IP address.
The hash chain
Each entry’s hash is the SHA-256 of the previous entry’s hash, a newline, and the entry serialized canonically. Changing, inserting or deleting an entry breaks the chain from that point. The banner at the top states whether the chain is intact, and Re-verify recomputes it. The console also verifies every workspace’s audit chain daily. The chain shows whether entries were changed after they were written. It cannot show that the newest entries were removed, because a chain cut short at the end still verifies. Export the log regularly and keep the head hash elsewhere if you need to detect that.Export
Export full log downloads the whole chain, oldest first, as JSON Lines (agentegrity-audit-<timestamp>.jsonl), whatever filters are set. Each line has the entry’s fields plus its prev_hash and hash. One export holds up to 100,000 entries. Exports are themselves recorded in the log.
The audit log is never deleted by retention, and it is available on every plan.