Evidence and verification
An evidence record states what an answer or action is based on: the question and answer as hashes, the cited sources, the applied rules, the result of the checks, the model, the cost, and for agents the approval.
When a record is created
Section titled “When a record is created”- for every answer in the chat and through MCP
- for every agent action through the NomOS gateway
- for every governance act, such as a new rule, a decision, or the approval of an exception
Anything that does not run through NomOS leaves no record. NomOS logs reads of individual resources in a separate, lighter log outside the signed chain.
Signature and chain
Section titled “Signature and chain”Every record carries an Ed25519 signature once the installation has a signing key. Without a key the field stays empty. Each record also points to the hash of its predecessor in the same room, so changing a record later breaks the chain.
Platform admins verify the chain and signatures in the interface or through
GET /api/platform/evidence/verify. The check counts records from before
signing was enabled as unsigned, not as errors.
The check protects well against changes as long as the signing key is kept separate from the database. A copy of the records in your SIEM makes later changes visible as well.
Evidence in your SIEM
Section titled “Evidence in your SIEM”Under Log shipping, NomOS delivers audit events to a SIEM:
- Pull: a SIEM fetches the events through a dedicated API with a cursor.
- Push: NomOS sends the events to a Splunk HTTP Event Collector.
- Formats: Ainomos JSON or OCSF 1.9.0.
NomOS sends metadata, never the plain text of questions or answers.