audit trail
Three artifacts survive a quarterly review of an AI agent. A per-decision log. A policy version stamp on every decision. A tamper-evident chain so the log can't be rewritten. Here's what Vibefixing emits today.
01 · decision log
For each supervised call, the evidence event records the input fingerprint, the reason strings, the threat signals that fired, the resulting decision (allow / deny / review), and a deterministic risk score.
02 · policy version
Policies are versioned YAML. The version that applied at the moment a decision was made is recorded with the decision — not 'whatever the current version says', so a fix shipped today doesn't rewrite history.
03 · tamper evidence
Events are hash-linked. A modification anywhere in the history breaks the chain on the next read, surfacing a verification failure rather than a silent edit.
Each threat has an OWASP LLM Top 10 reference (or an internal id where no public reference applies). Auditors usually want this column populated; it's populated.
catalog not reachable from this build
The threat catalog is served by the supervisor API. When this page renders in production, the table below is sourced live from /v1/threats/catalog. The current build returned no entries — likely the API is offline or this is a preview snapshot.
Compliance language gets sloppy fast. Three lines we hold:
for compliance buyers
Vibefixing artifacts mapped to GOVERN, MAP, MEASURE, and MANAGE. One page, no marketing, no promises beyond what the artifact actually contains. Built for the questionnaire response your security team has to fill in.