Govern · Audit and Evidence
Available nowKeep the evidence reviewers ask for
Halo records decisions, approvals, denials, costs, and configuration changes, with who or what acted and when. Audit logs and gateway decisions export as CSV and JSON, so reviewers can work with the evidence in the tools they use.
At a glance
- export formats for audit logs and gateway decisions
- CSV and JSON
- checkpoint statuses, pending, passed, failed, and skipped
- 4
Why it matters
Reviews stall when nobody can show what happened
Auditors, customers, and incident responders ask the same questions. Which agent acted, which policy applied, who approved it, and what changed?
- 01
Logs spread across tools make it slow to rebuild a timeline.
- 02
A decision without the policy and reason behind it is hard to defend.
- 03
Configuration changes that nobody recorded make drift hard to find.
Evidence trail
From one decision back to its context
An evidence checkpoint records its status and links to the run, session, policy, and approval behind it. An investigator can start at a blocked action and trace the rule that matched without searching separate systems.
- Status shows pending, passed, failed, or skipped
- Links lead to the run, session, and policy
- Approval notes are part of the record
- Filtered views export as CSV or JSON
Capabilities
Evidence across gateways, runtime, and settings
Halo records what was decided, who approved it, what it cost, and what changed, then makes the records easy to filter and export.
- Decision records
- Gateway decisions record the policy that applied, the outcome, and the reason, so reviewers can follow the logic behind a result.
- Approvals and denials
- Approval requests, reviewer decisions, notes, and denials are recorded and linked to the run that triggered them.
- Configuration history
- Changes to agents, policy bundles, users, and settings are recorded with the actor, the target, the action, and a timestamp.
- Cost attribution
- Usage and cost are attributed by agent and model, so spend questions can be answered from the same evidence.
- Filters and statistics
- Filter the audit log by actor, action type, target, and date range, and use statistics cards to spot unusual activity.
- CSV and JSON export
- Export audit logs and gateway decisions as CSV and JSON for SIEM ingestion, spreadsheets, or an auditor's request.
How it works
From a decision to a shareable record
Records are created where decisions happen, so nobody has to reconstruct them later.
- 1
Capture at the source
Gateways, the runtime, and the control plane emit events as decisions are made, approvals are handled, and settings change.
- 2
Link the context
Evidence checkpoints reference the run, session, policy, and approval involved, so one record leads to the next.
- 3
Review and filter
Open the audit log or an agent's security view, filter to the actor, action, or time window, and read the records.
- 4
Export for reviewers
Export the filtered records as CSV or JSON and attach them to a ticket, an assessment, or an audit request.
FAQ
Questions, answered
Halo records policy decisions, approvals, denials, costs, and configuration changes. Audit log entries include the actor, action, target, and timestamp, and gateway decisions record the policy, the outcome, and the reason.
Yes. Audit logs and gateway decisions export as CSV and JSON. You can filter by actor, action type, target, and date range before you export, which helps you scope an export to one incident or one review period.
Halo describes its evidence as reviewable and exportable, and it does not claim tamper-proof storage. If your program needs specific retention or integrity controls, export the records into your own retention system.
No. Halo records evidence that supports governance programs aligned to those frameworks, and it does not automate compliance mapping or certify anything. ISO/IEC 42001 is an AI management system standard that organizations certify against. Your team decides which evidence answers each requirement.
Account admins can view the audit log, and regular members do not have access to it. Reading pages and data is generally not logged, because the audit log focuses on actions that change state.
Put a halo around the AI your business runs.
See discovery, runtime policy, approvals, and evidence working together on your own use cases.