Bring the policy, the recorded decisions and the gaps into one review. Oktsec provides exportable evidence to support security reviews and SOC 2 audit workflows.
Connect the approved rules to the systems that reported them.
Policy
The permissions assigned to the workflow.
Systems
Where the policy was reported and where exceptions remained.
Period
Changes made during the review window.
The reviewer asks
“What did the agent request, and was it allowed?”
Support workflow · August 1–31
Illustrative review
Signed action evidence
Follow the recorded decision.
Review the available action context and check the signed record.
Request
The recorded caller and requested operation, where available.
Decision
The policy decision and recorded execution outcome.
Integrity
Verification against an independently trusted node identity.
The reviewer asks
“Do these records cover the whole review?”
Support workflow · August 1–31
Illustrative review
Coverage and exceptions
Make the gaps part of the answer.
A valid signature alone cannot establish a complete review period.
Reporting
Identify systems or periods without observations.
Export
Document filters, time ranges and export limits.
Coverage
Account for actions outside the configured integration.
Example questions and review steps, not customer records or a live Cloud export.
Recorded verification tests
Trust the record. Check its limits.
We tested an original record, a changed record and an incomplete action. Each tells the reviewer something different.
The included action checks out.
All four receipts verify, and the included action has a complete lifecycle.
Record integrity
Valid
Action lifecycle
Complete
The included records pass verification. This alone does not prove that every action was exported.
Verification details
4 of 4 receipts verified. Exit code: 0. Coverage: included batches only.
The change is detected.
We changed one character in a recorded resource without signing it again. Verification fails.
Record integrity
Failed
Action lifecycle
Incomplete
The altered record cannot be accepted as the original signed evidence.
Verification details
3 of 4 receipts verified. Exit code: 4. Coverage: included batches only.
The action is incomplete.
The remaining signatures are valid, but removing the final batch leaves the action without its final receipts.
Record integrity
Valid
Action lifecycle
Incomplete
Authentic records can still leave a gap. The reviewer needs both integrity and completeness.
Verification details
2 of 2 receipts verified. Exit code: 6. Coverage: included batches only.
Recorded September 9, 2026 with commercial Oktsec Node and synthetic test data. Not a live browser scan. Verification covers included batches, not the completeness of an export.
Available from Control and Cloud
The records behind the review.
Choose the evidence that answers the question. Keep the systems, dates and exceptions attached to it.
Workstation baseline
CSV
Which devices met the baseline?
Eight baseline checks, with ownership and dates. Failed and unobserved checks remain visible.
Policy review
Markdown
Which policy was deployed?
Reported policy state, coverage, exceptions and change history, with SOC 2 and ISO 27001 control references.
Activity history
CSV / JSON
What changed during the period?
Recorded agent activity and administrative changes within the selected systems, dates and export limits.
Signed action evidence
JSON
Can the action record be verified?
Node-signed receipts and lifecycle chains, checked against an independently trusted node fingerprint.
Ready for your compliance workspace.
Export the relevant files, review them with your team and upload them to the auditor’s workspace. Native Vanta and Drata connectors are not currently available.
These records support an audit; they do not establish certification or cover the full SOC 2 control set. Your auditor determines whether the evidence is sufficient.
Common questions
What to know before you start.
What is an AI agent audit trail?+
An AI agent audit trail records actions and their context, such as the caller, time, requested operation and outcome. Oktsec Node records covered actions at the configured integration; Cloud organizes the evidence for review and export.
How is signed action evidence different from an activity log?+
An activity log helps reconstruct recorded events. A signed action-evidence bundle additionally lets a reviewer check receipt hashes, signatures and lifecycle chains against an independently trusted node identity. These checks verify the included evidence; they do not prove that all activity was captured or exported.
Does Oktsec provide evidence for SOC 2?+
Oktsec provides supporting workstation observations, policy review reports, activity exports and signed action evidence. The organization and auditor determine the applicable controls, evidence sufficiency and audit outcome. Oktsec does not automatically make an organization SOC 2 compliant.
Can we send the evidence to Vanta or Drata?+
The current workflow is export-and-upload: select the relevant records in Oktsec and attach them in your compliance platform or auditor workspace. Confirm accepted formats and requirements with your reviewer. A native Oktsec connector is not currently provided.
Can an auditor verify the action evidence offline?+
Yes. The verifier supplied with the commercial Oktsec Node deployment can check an exported action-evidence bundle without a network connection or database. Supply the enrolled node fingerprint from an independent trusted source, then review the reported integrity, lifecycle completeness and coverage.
Does a valid signature prove the export is complete?+
No. The verifier checks the batches included in the bundle. It cannot prove that no batch was left out. Review export limits, period and integration coverage along with the verification result.
