For the complete documentation index, see llms.txt. This page is also available as Markdown.

Audit Every Action

Pull a verifiable trail of what your agent (or user) did.

Goal: pull a complete, tamper-evident record of every meaningful event for a tenant. Useful for compliance review, customer disputes, internal reporting, and proving to auditors that the right thing happened.

Reading the Trail

const events = await brain.audit.list("acme", {
  from:  "2025-09-01",
  to:    "2025-09-30",
  type:  "action.executed",  // optional filter
});

events.data.forEach((e) => {
  console.log(e.timestamp, e.type, e.actor, e.summary);
});
Type
When

source.connected

A source connected for the tenant

transaction.created

A new transaction landed

wiki.query

A natural-language question was asked

policy.evaluated

A policy decision was rendered

action.proposed

An agent proposed an action

action.approved

A human signed approval

action.executed

An action settled on its rail

audit.anchored

A Merkle root was anchored on Base

Verifying a Specific Action

For any action, you can pull a Merkle proof verifiable on-chain.

You can hand this to a counterparty or auditor. They can verify it without trusting Brain.

Pulling the Trace for One Action

Trace IDs link every event tied to one action.

You can paste a trace ID into the Console to see the same view rendered visually.

Exporting for Compliance Review

For SOC 2, ISO 27001, or any structured review, export the log as a file.

The export contains every event in the range plus the Merkle proofs needed to verify any of them after the fact.

Streaming Events Live

Use webhooks to receive audit events as they happen, then ship them to your SIEM, Datadog, Splunk, or wherever you centralize logs.

Filtering by Actor

Useful for "what did agent X do today?"

Or "what did user Y do?"

What You Don't Have to Worry About

Concern
Why Brain handles it

Tamper resistance

Every event is hashed and chained; Merkle roots anchor on Base hourly

Per-event signing

Anchorer keys live in HSMs; rotation is governed

Reorg safety

Reads wait for finality; cross-batch references catch dropped anchors

Privacy

Only Merkle roots and hashed tenant IDs are on-chain; no payload data leaks

What's Next

πŸ”Œ External Agent

Authorize an MCP-compatible agent and audit its actions the same way.

πŸ“¦ Audit and Proof

How the audit trail works underneath.

Last updated