Audit Trails That Survive Examination

I have sat with general counsel who could produce a model invoice and could not produce the decision. They knew tokens were spent. They did not know which template, which policy version, which redaction map, or which human allowed the run to complete.

That is not an observability gap. That is an accountability gap. Eridian exists to close it.

What we retain on every invocation

The signed record is not a debug log. It is the minimum set a supervisor can use to reconstruct work.

• request_id and workflow_run_id
• Project, desk, and workflow template version
• Actor (user or service account) and, where dual control applied, approver
• Residency region and pinning mode
• Route: primary model, fallback hops, cache hit or miss
• PII entity counts and redaction strategy
• Policy bundle hash (routing, residency, retention, dual-control flags)
• Cost in USD and token totals by hop
• Retention class and clock start
• Output hash; payload stored or omitted per class

We hash the output even when the payload is not stored. A later dispute can still prove what was returned without keeping the text past the clock.

SIEM export is not optional theater

Institutions do not want our UI to be the system of record. They want their SIEM, their GRC, their evidence locker. We export the signed record as structured events. We do not export raw prompts from a legal workflow unless the export action itself passes dual control.

If your SIEM team cannot join request_id to a case file, the trail is a brochure. We test that join in onboarding. We do not declare the deployment complete until it works.

What we will not decorate

We will not put a green badge on a project that only logs errors. Error-only logging is how you lose the one run an examiner cares about, which is usually a successful run that should not have been.

We will not let a workspace "sample 1% of traffic for cost reasons" on a regulated workflow. Sampling is a product decision for sandbox. Production legal and risk projects are 100% recorded or they are not production.

The standard

Every model invocation, every workflow, every exception sits under a named owner, a named control, and a record a supervisor can produce on demand. That is the operating thesis. The engineering is the means. If the record cannot be produced, the feature is not shipped.