PILLAR · INVESTIGATE & EXPLAIN
Reconstruct every governed action
Trace AI agents, model calls, tools, and downstream effects from one signed record.
Root cause
Scored, not guessed
Blast radius
Users, tools, spend
Next step
Named per incident
0 side effects
explain() dry runs
Incidents
An answer, not an alert
Violations escalate themselves
A policy hit becomes a structured incident, not a log line, and routes to Slack or PagerDuty.
Root cause, scored
Each incident names the determining rule and the events behind it, with a confidence score on the correlation.
Blast radius
Users, sessions, tools, models, and spend hit by an incident, computed straight from the signed trail.
Recommended actions
A concrete next step per incident, with the whole open, acknowledged, resolved lifecycle recorded.
Signed incident reports
Export signed event and incident evidence that can support your team's GDPR Article 33 assessment and reporting workflow.
Pivot on anything
Select any user, tool, or model and see everything else it touched across the trail.
Illustrative incident. Every field is computed from the signed trail.
explain()
The dry run for governance
explain() answers the counterfactual
The same PII scan and policy evaluation a real call would run, returning the verdict without sending anything anywhere.
No side effects, by construction
No quota consumed, no events emitted, no approvals filed, and anything not evaluated is named rather than silently omitted.
Byte-identical policy hashes
Node and Python derive the same rules_hash from the same rules, so explain() in CI proves a policy change did what you intended.
const verdict = explain('My key is sk-live-abc123, is it valid?')
decision block
rule_id ex-block-secrets
rules_hash e8c53c78786308e7
pii detected: true · types: ['api_key']
✓ no quota consumed · no events emittedEvent timeline
One surface for emitted governed activity
One live event stream
Emitted governed calls land on one timeline with model, latency, verdict, and incident reference; sampled or declared loss remains visible in the coverage story.
Policies edited live
Dashboard edits reach live SDKs within minutes with no redeploy, and each change is itself a signed, diffable event.
Drift is an event
Model swaps, SDK upgrades, and config changes are logged and diffed, with unauthorized changes flagged.
Point in time
The question that gets asked a quarter later
Reconstruct any moment
Which model version and policy were live last quarter comes from the anchored trail, not a dashboard that ages out.
Right to explanation
The recorded model, policy state, inputs, and output behind an emitted automated decision remain available for later review.