See exactly what the AI did: the action log
“Trust us” is not a security control. If an AI assistant touches your orders, stock or prices, you should be able to read what it did — not take anyone’s word for it.
What is recorded
Every action writes a row: the time, who acted (AI or human), the channel (SQL query, API call, local model, change request), what was asked, which tables were read, how many bytes left the server, and the outcome.
Three examples from a normal day:
- 14:02 — “Revenue this month?” → SQL, read order → 0 bytes sent out
- 14:07 — Reply to a customer about shipping → API, sent policy excerpt only, de-identified → 412 bytes
- 14:09 — Request to change 3 prices → paused, waiting for human approval
Why append-only matters
If the log can be edited, it is marketing, not evidence. Our entries can be added but never changed — not by the administrator, not by the AI. Deleting a whole form’s records is a deliberate, logged action.
What you can do with it
- Filter by day, by channel, or by “only show rows with egress”.
- Export CSV for Excel, or JSON for an auditor.
- Stop everything with one switch — the log keeps recording the stop.
The honest limits
A log shows what was sent, not what the provider does with it afterwards. That is why the log is paired with data minimisation: the fewer bytes you send, the less there is to worry about. And a log does not stop a determined insider — that needs access control and separation of duties.
