Glossary
What is audit by construction?
Audit by construction is the discipline of producing the audit record as a property of the action itself, not as a downstream reconstruction from logs.
§ 01 Definition
The record is part of the action.
Audit by construction is the discipline of producing the audit record as a property of the action itself, not as a downstream reconstruction from logs. When an AI agent takes an action, the record is produced as the action happens: who acted, on what data, on whose authority, with what outcome. The record is produced in the action's own execution path rather than reconstructed afterwards. Access control decides what may happen. The substrate records what did.
The opposite of audit by construction is audit by reconstruction, where the record is assembled later from logs, ticketing systems, and operator memory. Reconstruction works until the question is consequential. The first time an examiner asks for the trail, the gap between what was logged and what was actually done becomes the conversation.
§ 02 Questions
Audit by construction, answered.
What does audit by construction look like in practice?
At the moment an agent acts, the substrate writes an attributed event: the agent identity, the action class, the inputs, the outcome, the timestamp. The event is hash-chained to the previous event so the chain is verifiable from any point back to the start. Refusals are recorded as events the same as actions, each carrying the exact rule and version that fired. The record is produced in the action's own execution path, not written alongside it by a system that can fall behind.
How does audit by construction differ from cryptographic logging?
Cryptographic logging signs or hashes log entries after they are written, often by a separate logging system. Audit by construction makes the record part of the action's execution path: the substrate produces the record as the action happens; a runtime hook fires the event in the action's own execution path. Cryptographic guarantees still apply, but the load-bearing property is that the record exists at all.
Which regulatory frames are easier to satisfy with audit by construction?
Any frame that expects record-keeping or attribution: SR 26-2, NERC CIP, the EU AI Act record-keeping and human-oversight obligations, DORA attributable ICT operations, and the NIST AI RMF 1.0 Manage function. Audit by construction is the implementation-side discipline that makes the record-side burden satisfiable on demand.
§ 03 Related
Where the term lives.
Regulatory frames