Audit Trail

Every risk decision is logged with full provenance — back to the active profile version and characterisation corpus. Without ever recording what was asked or answered.

§ 01 · Per-Invocation Record

Everything about the decision —
nothing about the content

Each API call through Arkheia generates an audit record capturing the risk decision and its evidence — the model, the active profile, the signals evaluated, and the outcome. Prompt and response content are never included.

Example audit record

{
  "invocation_id":        "ark_inv_01JN4XMQR...",
  "timestamp":            "2026-02-24T09:14:22.341Z",
  "model_id":             "claude-sonnet-4-6",
  "provider":             "anthropic",
  "profile_id":           "claude-sonnet-v3.0",
  "profile_hash":         "sha256:a1b2c3d4e5f6...",
  "risk_level":           "MEDIUM",
  "confidence":           0.71,
  "evidence_depth":       "full",
  "features_evaluated":   5,
  "features_triggered":   2,
  "recommendation":       "review_before_acting",
  "response_token_count": 312,
  "finish_reason":        "stop"

  // No prompt. No response content. No user data.
}

§ 02 · Privacy Boundary

The audit trail stops at the content boundary

Logged

Invocation timestamp
Model ID and provider
Active profile ID and version hash
Risk level and confidence score
Number of features evaluated and triggered
Recommendation issued
Response token count and finish reason

Never logged

Prompt content
Response text
User identity or session data
Application business logic
Any personally identifiable information

§ 03 · Traceability Chain

From API call to corpus — full provenance

Every risk decision is traceable back to the exact profile version that produced it, and from there to the characterisation corpus that calibrated that profile.

API Invocation

Logged with timestamp, model, invocation ID, and risk outcome

Active Profile

profile_id + SHA-256 hash of the YAML profile file active at time of call

Characterisation Corpus

The controlled dataset used to calibrate that profile version — held securely

Validation Record

The per-model validation run confirming profile efficacy before deployment

§ 04 · Compliance Use Cases

Built for regulated environments

EU AI Act

Demonstrate that risk classifications were made systematically, with documented evidence, for each AI-assisted decision. The Arkheia audit trail provides per-invocation records with profile provenance.

Financial Services

Log AI output risk assessments for every model call involved in customer-facing or trading decisions. Traceability to the active profile version satisfies model governance requirements.

Healthcare & Life Sciences

FDA guidance on AI medical devices requires output validation. Arkheia audit records provide evidence of systematic risk assessment without storing patient data.

Internal AI Governance

Security teams can review which risk levels were assigned, which profiles were active, and when profile versions changed — without accessing any application or user data.

§ See It In Action

Ready to see the audit trail live?

Schedule a technical briefing to see per-invocation audit records on your own infrastructure.

Request Demo Data Architecture