Audit & Compliance
Audit logging and compliance for AI systems: SOC2, HIPAA, GDPR requirements, and automated compliance monitoring.
Last updated
After this section you can
- Specify the eleven-field audit record for every agent request and defend each field when an auditor asks you to reconstruct a decision
- Explain why a compliance log must be append-only, implement a hash-chained tamper-evident log with a verifier in ~10 lines of stdlib Python, and name the cloud WORM swap (S3 Object Lock compliance mode, GCS Bucket Lock)
- Run the volume-and-cost math for any request rate and entry size across hot/warm/cold tiers, and explain why a 7-year trail at 50K requests/day costs under a dollar a month
- Define the four automated compliance checks — PII-in-logs, retention enforcement, anomalous access, model-version drift — each with a concrete query, an alert threshold, and an owner
Audit Logging & Compliance Framework
Every AI decision must be as auditable as a human decision.
An audit log you cannot trust is worse than no log at all — it gives you confidence without evidence. The schema below is the easy part. The staff-grade questions are the three that follow it: can anyone silently rewrite the record (tamper-evidence), what does seven years of retention actually cost (less than you think), and what watches the log itself (four automated checks, because nobody reads a 3 GB-a-month log by hand).
You built tenant isolation in Multi-Tenant Isolation — every request carries a tenant_id and every query is scoped by it. Audit logging is the proof that isolation, and every other control, actually fired: when a regulator, an enterprise customer, or your own incident review asks “who saw whose data, and what did the model do,” this log is the answer. This section assumes the request path from earlier sections and turns the record of it into evidence.