Auditability & compliance

import { Aside } from “@astrojs/starlight/components”;

Enterprises cannot deploy agents that act as black boxes. Regulators, auditors, and internal risk teams need to know what an agent did, why it did it, and who was responsible. Alquimia Platform treats auditability as a first-class platform concern rather than a logging afterthought.

What makes an agent decision auditable

An auditable decision has four attributes:

Attribute	What it means in Alquimia Platform
Identity	Every request is tied to a user, service, agent, and agentspace.
Intent	The original prompt, channel, and runtime context are captured.
Reasoning	The worklog records every LLM call, tool invocation, shield verdict, and intermediate state.
Outcome	The final response, any action taken, and approval decisions are persisted.

Together these attributes answer the questions auditors actually ask: Who asked for this? What did the agent consider? What did it do? Who approved it?

The worklog as an audit trail

The worklog is an append-only record of every event produced during an inference run. It is the primary source of evidence for agent behavior.

Because Alquimia Platform’s execution engine is event-driven, the worklog naturally contains:

The incoming request and its correlation identifiers.
Each command the controller emitted and the corresponding response.
Tool inputs, outputs, and errors.
Shield verdicts and any profile changes triggered by the empathy engine.
Human approval requests and decisions.
Memory and context persistence events.

The worklog is stored in the persistent backend and can be queried by task, session, agent, user, or time range.

Correlation across signals

Audit evidence is more useful when it can be linked. Alquimia Platform uses shared dimensions across logs, traces, and metrics:

task_id — the inference run.
session_id — the conversation or workflow instance.
assistant_id — the agent.
agentspace_id — the organizational boundary.
user_id — the caller or channel sender.

This lets you move from a compliance report to the exact trace and log lines for the same run, or from a metric anomaly to the worklog entries that explain it.

Retention and immutability

For compliance purposes, the worklog should be treated as a record of record:

Store it in a database with backups and point-in-time recovery.
Restrict write access so worklog rows cannot be altered after insertion.
Define retention policies that match your regulatory requirements.
Export long-term archives to object storage or a SIEM if needed.

Common compliance scenarios

Requirement	How Alquimia Platform helps
Explainability	The worklog shows each reasoning step and tool result.
Non-repudiation	User, service, and agent identities are attached to every request.
Segregation of duties	Human approvals pause high-risk actions until an authorized person confirms them.
Access control	Agentspaces, role tiers, and Vault policies scope what each agent can access.
Data residency	The platform runs in your infrastructure; data never leaves your environment unless you configure it to.

Governance workflows

Auditability is not only about storage. It also enables governance workflows:

Dry-run mode lets you test an agent change against sample inputs without persisting side effects.
Versioned agent specs let you compare behavior before and after a change.
Hold and release let you pause an agent while it is reviewed.
OCI artifact distribution lets you promote approved agent packages through environments with signatures intact.

Practical audit questions

When preparing for an audit or review, you can answer the following directly from the platform:

Which agents are running in production and what versions are active?
What tools and secrets can each agent access?
What did a specific agent do for a given user or session?
Who approved a sensitive action and through which channel?
Were any shield blocks or policy violations triggered?
How did memory or knowledge retrieval influence the response?

Event-driven execution — how commands and responses become the worklog.
Observability — correlating metrics, traces, and logs.
Security concepts — identity, secrets, and shields.
How to inspect the audit worklog