The record, the papers, and the guidance behind them.
What Tovel can show, and what it is built to answer: the sealed record behind every agent action, the papers that explain the model, and the ASD and partner-agency guidance each control is designed to meet.
One record per action, chained to the one before.
Every governed action writes one record. Each carries the hash of the previous record, so removing or editing any one of them breaks the chain for everything after it.
The evidence chain
Append-only · SHA-256 · verifies against a public keyWhat one sealed record contains.
Every governed action writes one record: actor, accountable owner, data touched, the person who authorised it, the controls applied and a hash chained to the record before it. Workload payloads stay in your account; receipts carry hashes and metadata, and the control plane holds control-plane metadata only. The data flow for each record type is provided in the evaluation. The record proves what was decided and by whom.
Locker receipts are signed and hash-chained and export with their verification material. An auditor verifies the chain themselves. The chain establishes linkage against the supplied sequence; completeness also depends on trusted checkpoints, identity binding and the collection path, so a sealed record proves what was captured, and the coverage table says what is captured.
How the record is producedFour kinds of record, each with its own guarantee.
"Evidence" on this site means one of four things. They are signed, retained and exported differently, and a claim about one does not transfer to the others.
Signed and chained
One per governed action. Signed, hash-chained, exported with verification material. Default governance retention; compliance retention configurable.
Hash-chained
Control-plane changes: policy, rules, identity, provisioning. Chained, not individually signed. A change can commit before a journal failure is reported.
Retained in account
The full run: turns, tool calls, context loaded. Stays in your account under your retention. Referenced by receipts, not exported with them.
Provenance-linked
Consolidated memories point to source records. Provenance supports tracing and containment; source retention is set separately.
Sample downloadable receipt with public verification material, valid, altered and incomplete-chain examples, and a reproducible verification walkthrough: in preparation for this page. Until then, a live receipt is produced in the demo.
ASD guidance, and the control that answers it.
The Australian Signals Directorate and its partner agencies have published three documents in the last year that bear directly on agents in regulated estates. Each recommendation below is paired with the Tovel control built to meet it, so a risk team can check the mapping for themselves.
Assume compromise. Log the events that matter.
ASD responded to more than 1,200 incidents, up 11% on the prior year, and its critical-infrastructure factsheet asks operators to improve event logging, retire legacy systems and adopt secure-by-design products. In health and social assistance, attackers succeeded in 95% of incidents ASD handled.
On the platformCareful adoption of agentic AI services.
The joint guide asks organisations to give each agent a distinct identity, authenticate its interactions continuously, apply least-privilege access, test and red-team through the lifecycle, and limit agents to low-risk, non-sensitive tasks until controls are proven.
On the platformSecure integration of AI in operational technology.
A joint guide for critical-infrastructure owners and operators, covering ML, LLM and agent systems in OT. It sets out four principles for mitigating the risks AI introduces to the safety, security and reliability of OT environments.
On the platformMapping status: controls listed are shipped on governed paths unless marked otherwise on the Platform page. A dated control-by-control mapping to the September 2026 ASD agentic AI harnesses guidance, naming implemented, partial and prerequisite items, is in preparation and is not yet available on request.
Summaries are Tovel’s reading of public documents published on cyber.gov.au and by partner agencies. Figures are from the ASD ACSC Annual Cyber Threat Report 2024-25 and its critical-infrastructure factsheet. Tovel does not claim endorsement by ASD or any partner agency.
The model, written down.
Longer pieces for the people who have to defend a decision. One is published. Two are in build and are listed with that status.
The SOCI evidence enclave
How critical-infrastructure obligations become a continuous, cryptographically assured capability that keeps audit evidence current. About 12 minutes.
Read the paperAgentic AI under the joint ASD guide
A control-by-control mapping of the May 2026 Careful adoption guidance to enclave, harness and evidence.
Model change as an evidenced decision
Running the same workload under two models and producing a change record a risk function can approve.
Five things to ask any vendor for.
Bring these to Tovel too. Each one has a place on this site where we answer it.
A single sealed record for one real action.
The sample record above is the shape. In the walkthrough we produce a live one on the reference implementation; a record from your own estate follows in an evaluation.
Proof a record cannot be altered after the fact.
Append-only storage, SHA-256 chaining and a public key you verify against. Covered on the Trust page.
The named location where data and inference run.
AWS Bedrock and AgentCore in the region you choose, inside your account. Inference stays in that region.
What stops one action holding private data, untrusted content and external reach at once.
The Rule-of-Two gate, enforced in the tool layer. Described in layer 03 of the harness.
Which frameworks are scored, and which are explicitly not claimed.
Seven packs scored; CPS 234, SOC 2 and ISO 27001 not claimed. Listed under claims discipline.
Ask us for a live record.
In a 30-minute walkthrough we run one governed action and hand you the sealed record it produced. A record from your own estate follows in an agreed evaluation.
