Audit & Compliance

Autonomous agents take real action on real systems. Every governance decision and every action an agent takes is written to an immutable, tamper-evident audit trail — the authoritative record of what happened and why.

#Overview

The audit trail is the compliance backbone of the platform. Where observability exists to operate and debug, the audit trail exists to prove. It is a complete, immutable record of every governance decision the platform makes and every action an agent takes, captured with enough context to reconstruct exactly what happened.

Every governance decision is audited: there is no path through the platform where an agent takes a governed action without that decision being written to the trail.

#What is recorded

Each entry captures the decision and the context needed to reconstruct it: what was attempted, who or what attempted it, which policy applied, what the platform decided, and when.

• Policy decisions — every allow, deny, and escalate decision the governance layer makes, with the policy that produced it.
• Tool calls — every tool an agent invokes, with the request context and the decision that permitted or blocked it.
• Model outputs — final model outputs as they pass through governance, including any guardrail action taken.
• Escalations & approvals — every escalation to a human and how it resolved: approved, rejected, or timed out, and by whom.
• Action deliveries — every outbound action the platform dispatches on an agent's behalf.

#Immutability

The audit trail is append-only. Entries are never edited or deleted in place — the record grows forward, it does not change behind you. It is also tamper-evident: each entry carries integrity protection, so any alteration of a recorded decision is detectable rather than silent.

This is what makes the trail the authoritative record. When an agent's action is questioned weeks later, the audit trail is the source of truth — not application logs, not memory, not reconstruction.

#Compliance posture

Kraken AI is built for regulated environments. The same audit trail and governance controls that keep agents accountable also satisfy the review enterprise security teams require before agents touch sensitive systems.

• SOC 2 Type II — security, availability, and confidentiality controls covering how customer data is handled and protected.
• ISO 27001 — information security management aligned to the international standard.

The audit trail is the evidentiary backbone behind these controls. See Security & Trust for the current certification status and the platform’s broader security posture.

Compliance is reinforced by ownership: your audit logs, execution traces, and policy configurations are yours, exportable in standard formats. See Open by Default for how the platform treats portability.

#Data residency & retention

Where the audit trail lives is your decision. The platform's deployment options support strict data-boundary requirements — dedicated cloud instances as the baseline, private networking for teams that need isolation, and on-premises or air-gapped deployments for regulated environments where data cannot leave a specific boundary.

#Next steps

• Governance & Policies — How policies decide whether each agent action is allowed, denied, or escalated.
• Observability — Step-level execution traces, metrics, and cost — the operational view of every run.
• Deployment — Dedicated, private-networking, and air-gapped models that satisfy data-residency requirements.