AI connection evidence for the EU AI Act
Every decision logged, retained and exportable.
The connection-layer evidence chain compliance teams need for AI governance frameworks.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 10:04:11 | accept | j.rivera | policy: corp-office | greylist.mode | disabled to enabled |
| 2026-09-15 09:12:02 | accept | m.chen | list: approved-ai | entry | +app.summarizeit-pro.io |
| 2026-09-15 08:40:55 | block | m.chen | list: prohibited-ai | entry | +beta.voice-clone-studio.app |
| 2026-09-15 08:40:55 | accept | system | publish #4409 | auto | succeeded |
The framework asks who approved this and when
Record-keeping and human oversight are the two obligations every AI governance framework shares. Both require a record that an approval happened, by whom, and that the control operated afterward. Email threads do not survive an audit.
Inventory
Which AI services and agent destinations are in use, by team, since when.
Approval
Who allowed each one, on what basis, with what expiry.
Operation
Evidence the control enforced the decision on every lookup afterward.
Evidence kept by default
Inventory from the resolver
Per-site destination counts and first-seen events give the list without a survey.
Approvals as list entries
Each allow or block entry records the user, a source reference and an optional expiry.
Export and retain
Traffic Logs as CSV or JSON, the change log and publish history through the API, forwarded to the system of record.
Compliance capabilities
AI service inventory
By site and month, exportable. The list the acceptable use policy is written against.
Approval record
Every allow entry with user, source and expiry. Revocable and logged.
Change log
Every configuration change and publish. Rollback recorded like any other change.
Decision events
Every lookup with the action and reason. Retained per plan; forwarded for longer.
Human oversight
The Greywall hold is a documented review step. Held names wait for a person or a policy.
Roles
Console roles separate who can approve from who can view. API keys carry scopes.
One query for the assessor
Every first-seen AI service on the corporate policy in the assessment period, with the approval that followed. Same data from the API as CSV or JSON.
index=securd dns_q.event="new"
| eval site=coalesce('server.mobile_name','site_name')
| stats dc(dns_q.name) as new_names, values(dns_q.name) as names by siteQuestions teams ask
Which frameworks does this support?
EU AI Act record-keeping and human oversight, NIST AI RMF map and manage, and the boundary and audit controls in NIST SP 800-171 and CMMC. The mapping page states where each artifact applies.
Can we prove the control operated?
Yes. Every lookup after an approval or block is an event with the action. Export by policy and period.
Who can change a policy?
Users with the console role that permits it, and API keys with policies:write. Both are recorded in the change log.
Have the record before the audit
Inventory, approvals and events from one console, exported on request.