Answering the security review.

“What did your agent do in here, and by whose authority?”

Why the usual answers do not hold

The question comes from someone with no reason to trust you, no access to your systems, and no use for an answer that cannot be checked. Three things are normally reached for, and none of them survive that.

Your logs

You wrote them, you control them, and you are the interested party. To the reviewer that is not evidence — it is your account of yourself.

Your SOC 2

It attests to your controls in your environment. The question is about what ran inside theirs. An attestation about the first does not settle the second.

Your credential

If every agent presents the same service account, the credential identifies the integration, not the actor. One shared account is not one actor.

A log cannot carry a negative

Most of what a security review actually wants is a negative. Not show me what it did so much as show me it did not touch that.

A log is a list of things that happened. Turning that into this did not happen requires one more fact: that the list is complete. Completeness is a property of the watcher, not the watched — and it is the one thing telemetry never writes down. So found nothing and nothing was there arrive in exactly the same shape, and the difference is not recoverable afterwards.

Which is why the honest version of the answer, today, is prose. Someone writes a paragraph, and the customer decides whether to believe it.

What the record has to carry instead

Vartio is a system of record for agent authority: append-only, attributable, verifiable by a party that does not trust you. It is built around the four things the review is actually asking.

Was anything missed?

Coverage. What was observed, over which interval, with gaps declared rather than implied. Declared coverage is what lets silence mean something — it is the difference between a log and an answer.

Which one of them acted?

Actor. Which actor acted, not which credential was presented.

Who allowed it?

Authority. By whose grant, through which delegation chain, valid over which interval.

What do they get to see?

Disclosure. Scoped per tenant, provable in subsets. Proving one thing to one customer does not mean revealing everything to all of them.

The record does not depend on your good faith

What the customer receives is a dossier scoped to their tenant, carrying its own derivation — checkable without access to your systems, and without taking your word for anything.

That property comes from what sits underneath. Vartio runs on Ahti, an append-first store that preserves records exactly as they were submitted and interprets none of them. It does not summarise, score, or explain. That refusal is the point: a store that reinterprets its contents cannot later be used to settle an argument about them, because the interpretation is the vendor's too.

Vartio also sits beside the systems already producing evidence, not in front of them. It is not in the request path, and it cannot take production down — which is what makes it deployable inside a customer environment that is already nervous about your agent.

The commercial relationship changed before the evidence did

Software used to be sold as a tool. Increasingly it is sold as an actor — and the vendor is now accountable for conduct inside an environment they cannot see. Nothing in the existing stack was built to settle that. Logs were built for the operator debugging their own system, and attestations were built for a world where the vendor's software stayed on the vendor's side of the line.

So the question keeps arriving in security review, and it keeps being answered with prose. That works until the first time it is contested — an incident, an audit, a customer who wants the claim in writing — and then your own word is not evidence.