The code

Eight modules, two layers. Apache 2.0. Audit before you trust.

When your AI fails, someone has to be able to answer for it. We open-sourced the chain-of-custody layer for AI agent decisions, so anyone, including your own auditors, regulators, and customers, can verify what happened without taking us at our word.

Record layer · written after the action

ConductRecordThe signed, hash-chained log every other module writes to. One record per AI action, with the model version, system-prompt hash, retrieved sources, tool calls and output. Edit one and the chain breaks.

MetricRecordSigned aggregate metrics computed over those records and bound to the chain root, so a board, a union, or a regulator can verify the numbers behind an automated decision.

Gate layer · enforced before the action, in order

AuthorityGateWho issued this instruction, and are they authorised to bind the agent? Runs first. Source and authority only.As seen in: DPD prompt injection · Chevrolet “$1 Tahoe” chatbot

ConstraintGateDoes this action comply with the standing rules in force at that moment? Violations require explicit, recorded approval.

PersonaGuardDoes this reply match the agent's defined identity and scope? Catches persona drift and impersonation, whichever subsystem answered.

CitationVerifierIs every citation real? Checked against genuine legal, academic and technical sources before a document can ship.

VerificationGateIs this actually true? The claim is routed to a trusted source, never back to the model. The model proposes; a database disposes.

EgressGateDoes this output carry sensitive data, and is the destination inside the trust boundary? Runs where data would leave.As seen in: Samsung source-code leak · McHire data exposure

Read the source on GitHub →

Why independence matters

The people checking your AI shouldn't be the same people selling it to you.

The keys stay with you

Your company owns the signing keys and keeps its own records. Not us.

If a regulator asks what your AI did, you have the evidence in your own system. You don't need to ask a vendor to hand it over.

Free, because you should be able to check

The code is free and open source under Apache 2.0.

You can see how it works, have someone independent check it, or change it to suit your needs. No licence fees. No being locked into Headlights.

You shouldn't have to take our word for it either.

Open for anyone to see

The code is already on GitHub. Anyone can read it, test it or build on it.

Alongside it, I'm building a public library of real AI incidents, adding new cases every week.

The audit tool is also mapped to a proposed AI Agent Audit Trail standard submitted in March 2026. It's still a draft, not an adopted IETF standard.

Want to write back?

Direct to my inbox.

ellie@useheadlights.com →