Glossary
What is audit by construction?
Audit by construction is the discipline of producing the audit record as a property of the action itself, not as a downstream reconstruction from logs.
§ 01 Definition
The record is part of the action.
The record is produced in the action's own execution path rather than reconstructed afterwards. Access control decides what may happen. The substrate records what did.
The opposite of audit by construction is audit by reconstruction, where the record is assembled later from logs, ticketing systems, and operator memory. Reconstruction works until the question is consequential.
§ 02 Questions
Audit by construction, answered.
What does audit by construction look like in practice?
At the moment an agent acts, the substrate writes an attributed event: the agent identity, the action class, the inputs, the outcome, the timestamp. The event is hash-chained to the previous event so the chain is verifiable from any point back to the start.
How does audit by construction differ from cryptographic logging?
Cryptographic logging signs or hashes log entries after they are written, often by a separate logging system. Cryptographic guarantees still apply, yet the load-bearing property is that the record exists at all.
Which regulatory frames does audit by construction help you satisfy?
Any frame that expects record-keeping or attribution: SR 26-2, NERC CIP, the EU AI Act record-keeping and human-oversight obligations, DORA attributable ICT operations, and the NIST AI RMF 1.0 Manage function.
§ 03 Related
Where the term lives.
Regulatory frames