Runtime evidence · Aug 31, 2026
Evidence an auditor can check. Not a dashboard you have to trust.
Pipelock records what an AI agent's traffic did as signed, hash-linked receipts, from a boundary outside the agent process. Verify a real capture in your browser below. No account, no vendor service, and the verifier prints its own limits with the verdict.
- Operator-held key
- Offline verification
- Reproducible capture
- Stated limits
- Apache-2.0 verifiers
The short version
What this proves, and what it does not
Proves
Every allow and deny decision on routed HTTP, WebSocket, MCP, and agent-to-agent traffic becomes an Ed25519-signed receipt in a hash-linked chain with signed checkpoints. Anyone with the operator's public key verifies the signature, integrity, and ordering offline. The deployer holds the signing key. We never see it.
Does not prove
A valid chain covers the records supplied. An operator who holds the key could omit records before signing. Receipt scope ends at the mediation boundary, and without the containment step the verifier reports containment as UNKNOWN rather than implying it. Pipelock emits evidence a SIEM consumes; it does not run the alerting or incident process.
Where the evidence comes from
The mediation boundary
The recorder sits outside the agent process. A prompt-injected agent cannot skip a boundary it does not operate. It can only bypass the proxy if the containment step was skipped, and that state is disclosed, never assumed.
Evidence output Every decision becomes a signed receipt in a hash-linked chain, verified offline with the operator public key, no vendor service.
Mapped to the standard
AIUC-1 accountability control coverage
26 controls reviewed against the AIUC-1 2026-07-15 text. An evidence mapping, not a certification claim. Every row, with the honest limit stated, is below on this page and in the packet PDF.
Row by row
The full control mapping
Every reviewed control, the capability behind it, the artifact an auditor receives, and the honest limit. Mapped means Pipelock can supply the stated evidence for the traffic it mediates, never that Pipelock alone satisfies the requirement.
Direct
8 controlsShipped Pipelock control with shipped evidence, inside the mediation boundary.
E015 Log AI system activity Direct
Pipelock capability
Signed action receipts carrying mediated decision, policy hash, transport, scanner layer, and correlation context.
Evidence artifact
Receipt chain; independent verifier output; Audit Packet v0 only where emitted.
Honest limit
Direct for Pipelock decisions. Not an agent transcript and not a record of unmediated processes, reasoning, or outputs.
E015.1 Logging implementation Direct
Pipelock capability
Flight recorder and structured events for mediated enforcement decisions.
Evidence artifact
Receipt and flight-recorder configuration; sample chain; verifier output.
Honest limit
Direct, within the mediation boundary.
E015.4 Log integrity protection Direct
Pipelock capability
Ed25519-signed receipts, hash-linked ordering, signed checkpoints, and offline Go, TypeScript, Rust, and Python verifiers; the browser wasm reuses the Go implementation.
Evidence artifact
Receipt chain and checkpoints; signer public key supplied from a documented source outside the packet; verifier output.
Honest limit
Direct for integrity and ordering of supplied records. It does not prove completeness, prevent an operator from withholding a whole packet, or make an operator-held signer independent.
D003 Restrict unsafe tool calls Direct
Pipelock capability
The MCP proxy performs pre-execution input scanning, tool scanning, tool policy, and chain detection when configured.
Evidence artifact
Per-call signed receipts; verifier output; Audit Packet v0 only where emitted.
Honest limit
Direct for mediated MCP tools. It does not control tools an agent reaches outside Pipelock.
D003.1 Tool authorization and validation Direct
Pipelock capability
MCP tool-policy allow, deny, and redirect rules plus MCP input scanning.
Evidence artifact
Policy configuration and hash plus tool-call receipts and verifier output.
Honest limit
Direct when enabled. Policy must be scoped and reviewed by the deployer.
D003.3 Tool call log Direct
Pipelock capability
MCP records mediated tool-call decisions, policy context, and receipt correlation.
Evidence artifact
MCP receipt chain; Audit Packet v0 only where emitted; verifier output.
Honest limit
Direct for the mediated call log. The actual MCP slice must show the fields claimed; retention, access controls, and unmediated calls belong to the deployment.
B006.2 Agent security monitoring and alerting Direct
Pipelock capability
Enforcement receipts and security-event and webhook output.
Evidence artifact
Receipt chain; event-export configuration; external monitoring evidence.
Honest limit
Direct for logging mediated boundary violations; partial for alerting. The organization supplies alert routing and response.
B002.1 Adversarial input detection and alerting Direct
Pipelock capability
Inbound and outbound prompt-injection scanning, MCP input and response scanning, and events on detections.
Evidence artifact
Detection configuration; block receipts; event-export configuration.
Honest limit
Direct for configured, mediated content. No claim about inputs that never reach Pipelock.
Conditional
3 controlsDepends on the deployment or configuration named in the row.
B006.1 Agent service access restrictions Conditional
Pipelock capability
HTTP and MCP policy enforcement, MCP server and tool policy, and the optional contain egress boundary.
Evidence artifact
Policy configuration; deny receipts; contain verification output where deployed.
Honest limit
Network non-bypass requires the managed containment or deployment boundary; proxy configuration alone does not stop direct egress.
B006.3 Execution-level safeguards Conditional
Pipelock capability
MCP tool-definition scanning and drift detection with pre-execution policy; Linux containment uses managed identities and nftables.
Evidence artifact
Policy configuration; tool-drift or policy-deny receipts; containment posture output.
Honest limit
Kernel containment requires the supported Linux and nftables deployment and successful verification; it is not a universal runtime sandbox.
B008.2 Agentic-interface transport security Conditional
Pipelock capability
TLS proxy and interception deployment support.
Evidence artifact
Deployment TLS configuration and, where applicable, mediated receipt context.
Honest limit
Pipelock cannot prove every model, MCP, or agent-to-agent connection is TLS-protected, and TLS interception itself needs a correctly managed CA deployment.
Partial
8 controlsUseful evidence, with the stated gap. Offer it as an input, never the whole answer.
E009 Monitor third-party access Partial
Pipelock capability
Inline HTTP, WebSocket, MCP, and agent-to-agent mediation; MCP session binding; policy and scanner decision context.
Evidence artifact
Signed action-receipt chain and offline verifier output; Audit Packet v0 only when a producer actually emits one.
Honest limit
Mediated traffic only. It can evidence traffic observed at Pipelock's control point, not a complete inventory of third-party connections, user or authentication sessions, or data access. Plain CONNECT exposes hostname-level data unless TLS interception is enabled.
E009.1 Third-party access monitoring Partial
Pipelock capability
The same mediation plus request and decision metadata and SIEM or webhook event emission.
Evidence artifact
Receipt chain, selected event-export configuration, and verifier output.
Honest limit
Partial for mediated connections. The packet must identify which access-metadata fields were captured; Pipelock is not the SIEM and does not by itself establish user identity, authentication events, retention, or access authorization.
E015.2 AI agent logging implementation Partial
Pipelock capability
MCP input, tool, policy, and chain scanning with receipt correlation.
Evidence artifact
MCP receipt slice; Audit Packet v0 only where emitted; verifier output.
Honest limit
Tool-call evidence is available on mediated MCP paths, subject to the selected capture and redaction configuration; Pipelock does not supply agent provenance, all delegations, human approvals, reasoning traces, or a complete record of parameters and results.
D003.2 Rate limits for tools Partial
Pipelock capability
Request rate limiting and data budgets on mediated paths.
Evidence artifact
Active configuration and receipts or events for enforcement.
Honest limit
Pipelock limits mediated requests; it is not a complete per-tool transaction-cap system.
D003.5 Tool-call-log reviews Partial
Pipelock capability
Queryable receipt and event evidence can be an input to a review.
Evidence artifact
A reviewer-produced periodic review record, linked to verified evidence.
Honest limit
Pipelock does not conduct the periodic review or make permission-retirement decisions.
B002.2 Adversarial incident and response Partial
Pipelock capability
Timestamped block evidence and event emission.
Evidence artifact
Receipt chain plus a real incident record owned by the organization.
Honest limit
Pipelock does not create, assign, or resolve incident tickets.
A008.1 Secrets detection in user inputs Partial
Pipelock capability
DLP scanning on traffic and content Pipelock receives.
Evidence artifact
DLP policy configuration; block receipt with redacted evidence; verifier output.
Honest limit
It is not a product UI warning and cannot see prompts that bypass mediation.
B008.3 Agentic-interface data integrity Partial
Pipelock capability
MCP input and tool scanning with optional mediation metadata.
Evidence artifact
The relevant configuration plus MCP receipts.
Honest limit
This is evidence of mediated inspection, not a claim of universal MCP schema validation or cryptographic authentication of every agent-to-agent message.
Not covered
7 controlsDo not offer Pipelock as evidence for these controls. Saying so is the point.
E009.2 Anomalous third-party access alerting Not covered
Honest limit
Pipelock emits security events a SIEM can consume, but it does not itself provide anomaly rules, case assignment, triage notes, or resolution records.
D003.4 Human-approval workflows Not covered
Honest limit
Pipelock does not supply approval workflow, approver identity, or ticket evidence.
B008.1 API and agentic-interface authentication Not covered
Honest limit
Pipelock may observe auth-related metadata but does not provide organization-wide API, OIDC, or mutual-auth controls.
B008.4 Model hosting security Not covered
Honest limit
Pipelock does not secure model images, GPU isolation, or hosting infrastructure.
B008.5 Model integrity verification Not covered
Honest limit
Pipelock does not verify model artifacts before or during deployment.
A008.5 Secrets redaction in logs and stored artifacts Not covered
Honest limit
Optional redaction covers mediated request paths, and receipts record redaction context rather than plaintext values, but that cannot establish sanitation of conversation history, application logs, or every stored artifact.
E015.3 Log storage Not covered
Honest limit
Retention, WORM storage, access control, and deletion policy are deployment-owned.
Run the check
Verify it yourself, in your browser
This capture came from the shipped release binary and was frozen after shutdown sealed the chain. The verifier runs as WebAssembly in your browser. Nothing is uploaded. To check a receipt of your own, use the receipt verifier.
Ready. Click verify to run the check in your browser.Or from a terminal: pipelock verify-receipt --key <public-key> evidence-proxy-0.jsonl