Evidence for AI agent governance: what the frameworks ask and what kosa8 records

Updated 2026-10-31

AI governance frameworks keep asking the same three things of an AI agent: a record of what it did, a person who can oversee and stop it, and limits on what it can reach. kosa8 supports evidence for all three with a tamper-evident audit log, signed approvals, a signed organisation policy and an evidence package an assessor can verify offline. It is evidence, not an assessment: kosa8 holds no certification and no third-party audit report.

01What kosa8 produces as evidence

Evidence	What it shows	Command
Audit log	Every state-changing action, brokered network request, refused connection, tool decision and approval, with its actor and time; hash-chained, HMAC-keyed and signed with Ed25519	`kosa8 audit verify`
Evidence package	The entries about a sandbox, snapshot, approval, session or time range, with the surrounding chain and the machine's hardening report, signed	`kosa8 evidence export`
Signed policy	The organisation's rules (registries, egress, required sandbox, allowed MCP servers and tools, approvers), signed with Ed25519; a tampered policy refuses everything	`kosa8 policy show`
Approvals	Which named people approved which risky action, signed by them and recorded once used	`kosa8 approve status REQUEST`
Configuration baseline	Whether this machine meets the hardening baseline, mapped to NIST SP 800-53 control families	`kosa8 doctor --compliance`
SIEM feed	The log exported or forwarded off the machine, to syslog, Splunk HEC or HTTPS	`kosa8 audit export --format cef`

The recipient does not need kosa8 running to check a package: kosa8 evidence verify uses only the package, and kosa8 evidence verify --web verifier.html writes a single offline HTML page that runs the same checks in a browser.

02EU AI Act: record-keeping and human oversight

What it asks. Article 12 of Regulation (EU) 2024/1689 says high-risk AI systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system", to support traceability, post-market monitoring and the deployer's monitoring. Article 26(6) requires deployers to keep the logs under their control for a period appropriate to the purpose, of at least six months unless other law says otherwise. Article 14 and Article 26(2) require human oversight by people with the competence and authority to exercise it. These duties attach to high-risk AI systems; whether an agent's use is high-risk depends on what it is used for under Article 6 and Annex III.

What kosa8 provides. Automatic, per-action event records with actor, time, target and outcome, written by the host service rather than the agent. Retention you control: kosa8 audit prune seals old entries so the chain still verifies, and a signed policy can set a floor with min_audit_retention_days. Oversight: actions held for a named person, with each approval recorded.

Deep dive: what an audit log for AI agents should record.

03SOC 2: access, monitoring and change

What it asks. A SOC 2 report is an examination by an independent CPA firm against the AICPA's Trust Services Criteria (security, availability, processing integrity, confidentiality and privacy). It is a report on an organisation's controls, not a product certificate. The common criteria on logical access (CC6), system operations and monitoring (CC7) and change management (CC8) are where AI agents come up: who an agent acts as, what it can reach, and how its actions are detected and reviewed.

What kosa8 provides. For access: per-agent identities with scoped tokens, a network allow-list enforced on the host, and API keys held outside the sandbox. For monitoring: the audit log and its forwarding to your SIEM, including every refused request. For change: a signed policy that cannot be weakened on a developer's machine, and tool definitions pinned by digest so a changed tool is withheld until reviewed. Your auditor decides what counts as sufficient evidence; kosa8 itself has no SOC 2 report.

04ISO/IEC 42001: an AI management system

What it asks. ISO/IEC 42001:2023 sets requirements for establishing, running and improving an AI management system. Its Annex A lists reference controls, among them A.6.2.8, "AI system recording of event logs", which asks the organisation to decide where in the AI system's life cycle event logging is enabled. The full text is sold by ISO, so this page names the control and does not quote it.

What kosa8 provides. Event logs for every agent in use, a documented and signed policy that shows how agents are constrained, and an evidence package that shows the controls operating on real actions rather than on paper.

05NIST AI RMF: govern, map, measure, manage

What it asks. The NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023) is voluntary. It organises AI risk work into four functions, Govern, Map, Measure and Manage. NIST's Generative AI Profile (NIST AI 600-1, July 2024) applies it to generative AI. Both expect documented policies, defined human oversight roles, and records that let incidents be traced and responded to.

What kosa8 provides. For Govern: the signed policy and named approvers. For Manage: containment per agent, a network allow-list, approvals for escalating actions, and checkpoints that roll a machine back. For tracing incidents: the audit log and evidence export. For organisations that also work against NIST SP 800-53, kosa8 doctor --compliance checks a hardening baseline whose controls name the matching families (for example AU-9 for audit protection and SC-7 for boundary protection).

06What this evidence does not show

kosa8 checking its own configuration is evidence for a control, not an assessment of it. No tool on the system under review can assess itself.
The log is tamper-evident, not tamper-proof against someone with full control of the host. Forward it to a system that person cannot reach.
Prompts and model output are not recorded unless the organisation's policy turns recording on, and request bodies are never recorded.
There is no hosted admin console and no SAML or SCIM integration; policies are signed files you distribute.

For the isolation model and threat model behind these records, see kosa8 security.

07Questions

Does kosa8 satisfy EU AI Act Article 12 on its own?

No. Article 12 is an obligation on providers of high-risk AI systems, and Article 26 sets duties for deployers. kosa8 supplies automatic, tamper-evident event logs for each AI agent, which supports evidence for those duties; whether the obligations are met depends on the system, its use and the rest of your controls.

Does kosa8 have a SOC 2 report or an ISO/IEC 42001 certificate?

No. kosa8 has no SOC 2 report, no ISO/IEC 42001 certificate and no external penetration test yet. It produces evidence your own auditor can use: the audit log, signed approvals, the signed policy and evidence packages.

What does an assessor need to check a kosa8 evidence package?

The package and your public key, sent through a separate channel. kosa8 evidence verify checks it with no kosa8 service, state or network, and kosa8 evidence verify --web writes an offline HTML page that runs the same checks in a browser.

How long does kosa8 keep audit logs?

Until you prune them. kosa8 audit prune moves old entries into sealed segments so the chain still verifies, never removes entries a forwarding sink has not received, and a signed policy can set a minimum with min_audit_retention_days.

08Guides and deep dives

09Sources

10Try it on your own machine

kosa8 installs with one line on macOS and Linux. Sandboxes run locally on Apple silicon Macs and x86-64 Linux.

Download kosa8 See pricing