Audit trail

Every decision, approval and execution is written to your organisation's audit trail: a record of who did what, when, that can't be quietly edited.

How it holds

Each organisation has its own chain of audit events. Every event carries a sequence number and a hash that covers the event and the hash of the event before it, so changing or removing any event breaks every hash after it.

At intervals, TaskGate seals the chain with a checkpoint signed with an Ed25519 key. A checkpoint fixes the state of the chain up to that point, so it can be checked later against the signature.

Each event records the actor, the action, what it acted on, the workspace and when it happened. An event's payload can be redacted — for example to honour a deletion request. The payload is dropped, the reason is recorded, and the event's hash stays, so the chain still verifies.

Verify the chain

The Audit page in the console shows the chain and how many events are sealed so far. Run a verification to recompute every hash from any sequence number:

• Chain intact. — every event checked, none altered.
• Chain broken at … — the first sequence number where a hash does not match its event.

Export for an auditor

The audit export streams a range of events as newline-delimited JSON, together with the signed checkpoints for that range and the public keys needed to check their signatures. The export carries what is needed to recompute the hashes and check the checkpoint signatures.

On Observability, a New evidence export produces a tamper-evident, signed bundle. On Governance, Audit packages are sealed evidence bundles for a period.

Decisions in detail

Each policy decision is stored with the policy versions it used, the rules that matched, the raw and effective outcome and a snapshot of the inputs. The Decisions page lists them.