Trust layer: decision chains, replay, and audit

Decision chains

Each governed action or model round becomes a step in a decision chain: what was requested, which policy rules applied, what was decided, and who approved it if approval was needed. The chain is the record a reviewer uses to answer “why did the agent do that?”

Run trace

ARIA records every tool call made by agents, workflows, and external agents using the MCP gateway, and who or what started each run. The trace for a run shows its tool calls in order. Recording never blocks a run, and captured payloads are encrypted.

Replay that tells you when it can’t replay

If a run was not recorded in enough detail, or the re-evaluation itself fails, ARIA reports Not replayable and names the reason. It does not show a clean result for a chain nobody actually re-checked. In a review, the absence of a comparison should never read as agreement.

Run replay modes

model-only

Repeats a single model call.

tool-cassette

Repeats the whole agent loop using the tool outputs recorded the first time, and stops at the first divergence.

Replay reports what changed. Because it calls the model again, it consumes tokens and respects budgets, and it does not promise byte-identical output. That is the point of the diff: it shows whether the answer held.

Deterministic decision process

When enabled, ARIA runs agents in deterministic mode: temperature zero and, where the model provider supports it, a fixed seed derived from the agent, input, and model. The orchestration around the model, including workflow, context, and policy, follows the same path each time for the same inputs. Language models remain probabilistic, so ARIA treats determinism as a discipline for reducing variation and making variation visible. It is not a guarantee of identical text.

Tamper-evident audit

Every audit record is chained to the one before it with an HMAC-SHA256 hash. Records are stored in segments. On OpenSearch 2.19 and later, the segment being written is created append-only, so it refuses updates and deletes, and each full segment is sealed with a signed checkpoint. A daily incremental verification and a weekly full verification check the chain, and the system can detect deletion or replacement of entries it has already verified. Retention is configurable and expired segments are deleted whole.

Enlarge

System of record and evidence export

• System of record. A unified timeline of decision steps, audit events, approvals, policy revisions, and governed actions, plus per-run reconstruction.
• Governance insights. Analytics on denial patterns, approval latency, policy drift, and repeated prompt-injection findings. Insights can propose a draft policy rule, which stays disabled until an administrator reviews it.
• Evidence export. Asynchronous export jobs produce JSON, partial OSCAL 1.1.0 assessment-results, or a ZIP package containing a compliance snapshot, an audit integrity proof, policy summaries, and sample decision chains. Exports are intended to supplement a System Security Plan, not replace it.
• Security event forwarding. Forward events to Splunk, Datadog, Elasticsearch/OpenSearch, or syslog in CEF or ECS format, with disk spooling and retry so events survive a restart.

ARIA Score

ARIA Score gives each run a 0–100 grade across six dimensions: veracity, guardrail compliance, explainability, grounding, usefulness, and determinism. It is a governance indicator built from signals ARIA already has, such as whether output validation passed, whether policy was applied, and whether an explanation record exists. It is not a measurement of factual accuracy.

Frequently asked questions