AI Governance · Risk · Assurance

Know what your AI did.
Prove who was accountable.

Garlip AI Audit gives senior managers, compliance officers and internal audit teams a consolidated record of AI use across the organisation — from the first prompt to the final agent action.

Capture prompts, outputs, model and policy versions, retrieved evidence, tool calls, delegated authority, approvals and outcomes through one model-independent audit layer, comprehensive API and governance dashboard.

Request an Executive Briefing → Explore the Audit Trail

AI Governance Record / IllustrativeEVIDENCE CAPTURED

09:31:04.182

Request authenticated

Named user · role · application · delegated authority · policy version

IDENTITY / AUTHORITY

09:31:05.024

Context and sources retrieved

Document IDs · versions · retrieval events · source references

EVIDENCE / PROVENANCE

09:31:08.491

Model response and agent trace recorded

Input/output · model metadata · tool calls · policy checks

MODEL / AGENT ACTIVITY

09:31:12.073

Human review recorded

Reviewer · decision · amendments · escalation rationale

OVERSIGHT / DECISION

DEMONSTRATION DATA · Illustrative sequence, not a live production feed

⌁Model-independent integration

◈Tamper-evident records

⌘Comprehensive API & dashboard

▦Client-controlled cloud options

For Senior Managers

AI accountability needs evidence, not assurances.

AI use is spreading across business units, vendors and workflows. When a decision is challenged, leadership needs to establish what the system received, what it returned, what it did next, which controls applied and who had authority to approve the outcome.

◉

Senior managers & executives

Gain organisation-wide visibility of AI activity, material actions, control exceptions and accountable owners. Support governance reporting with evidence that can be inspected, not just high-level assurances.

▤

Compliance officers

Search and reconstruct individual AI interactions, review policy and escalation events, investigate complaints and assemble evidence packs for internal review or regulatory engagement.

⌕

Internal audit, risk & security

Test whether controls operated as intended. Examine access, model changes, agent tools, exceptions and approvals across supported AI systems using a consistent evidence schema.

✓

Reconstruct consequential AI activityFollow a trace from user request through model, tools, human review and recorded outcome.

✓

Connect actions to authorityRecord user identity, roles, permissions, service identities and approval events.

✓

Find control failures fasterSearch exceptions, policy results, failed tool calls, overrides and escalations.

✓

Prepare evidence for reviewExport scoped records, timelines, provenance and integrity-verification information.

What Garlip Records

Beyond prompts and outputs.

A transcript alone cannot explain an agentic workflow. Garlip brings together the surrounding evidence needed to understand the sequence, authority and context of AI-assisted activity.

↔

Full interaction record

Prompts, system-instruction versions, model responses, timestamps, model identifiers, parameters, transformations and available safety-filter results.

⌘

Agent and tool traces

Tool invocations, arguments, results, API calls, retrieval events, retries, hand-offs, failures and recorded external actions, linked by correlation ID.

◉

Identity & authority

Authenticated users, roles, service identities, delegated permissions, approval steps, reviewer decisions and recorded reasons for overrides or escalation.

▧

Source provenance

References to retrieved documents, versions, citations and context supplied to the model, subject to the integration and source system's available evidence.

⌖

Policy & control evidence

Applicable policy versions, risk classifications, control outcomes, blocked actions, exceptions, escalation events and review status.

▤

Search, reports & exports

Filter by user, time, application, model, case, event type or policy. Export a chronological evidence pack with integrity-verification details.

Architecture

One audit layer.
Across your AI estate.

Designed to fit existing controls.
Use a gateway for direct capture where appropriate, or integrate with applications, SDKs, APIs, webhooks and vendor logs. Capture coverage depends on the integration path and source system.

Capture across providers

Integrate supported public models, private deployments, internal applications and agent frameworks. Normalise events into a consistent, searchable record without requiring a single model vendor.

Model-independent

Correlate the whole workflow

Link user requests, model calls, retrieved context, agent tools, decisions and business actions with event IDs, session IDs, timestamps and trace relationships.

End-to-end traceability

Apply governance controls

Connect activity to identity, access policy, risk classifications, human review, escalation rules and accountable owners. Configure controls to the organisation's operating model.

Control evidence

Protect and retain evidence

Encrypt records, apply access controls and retention policies, and distribute encrypted record fragments across separate cloud storage locations for resilience and reduced concentration risk.

Secure evidence store

Investigate through one dashboard

Give authorised teams a consolidated view to search, reconstruct timelines, investigate exceptions, verify record integrity and export evidence for audit or supervisory review.

Operational visibility

Integration & Operations

A comprehensive API.
A dashboard built for oversight.

Garlip is designed to fit the firm's existing architecture and workflows. Integrate capture into AI applications, send events from agent runtimes, query audit records, automate evidence exports and connect governance workflows to existing systems.

POST   /api/audit/events
GET    /api/audit/traces/{traceId}
GET    /api/audit/events?from=&to=&actor=
GET    /api/audit/cases/{caseId}/evidence
POST   /api/audit/exports
GET    /api/audit/integrity/{recordId}

Capture APISubmit prompts, outputs, identity and agent events from supported applications.

Trace APIRetrieve a correlated timeline across model calls, tools, approvals and outcomes.

Governance dashboardSearch activity, view exceptions, investigate cases and review control status.

Evidence exportGenerate scoped reports with source references and integrity-verification data.

Access & tenancyIntegrate identity, role-based permissions and organisation-level separation.

System integrationConnect supported SIEM, case-management, GRC and reporting workflows.

Illustrative encrypted-record architecture

RECORD / TRACE 7F21UTC · SIGNED CHECKPOINT

Encrypted structured event record

Identity · timestamp · authority · prompt/output references · agent events · policy result · integrity metadata

↓ ENCRYPTED JSON RECORD · FRAGMENTED FOR STORAGE

FRAGMENT A
Cloud / Region 1

FRAGMENT B
Cloud / Region 2

FRAGMENT C
Cloud / Region 3

↓ AUTHORISED RECONSTRUCTION + INTEGRITY CHECK

GOVERNANCE DASHBOARDACCESS CONTROLLED

Verifiable evidence for authorised review

Reassemble permitted records, check integrity, inspect the event timeline and export a trace or case evidence pack.

Conceptual architecture. Storage topology, fragmentation method, redundancy and recovery controls are configured to deployment requirements.

Tamper-Evident Audit Trail

Evidence protected across clouds — under your control.

Garlip records AI activity as structured, encrypted JSON events. The encrypted records are fragmented and distributed across multiple cloud storage locations to support resilience and reduce reliance on a single storage location. Where required, those clouds and accounts can be owned and controlled by the client.

Prompts, outputs and supported agent events linked to identity and UTC timestamps
Encrypted records fragmented across separate cloud locations for security and redundancy
Client-owned cloud accounts and storage architecture available where required
Access controls and auditable access to records and exports
Integrity verification designed to help identify unauthorised alteration or incomplete records
Retention, recovery and evidence-export policies configured to client requirements

Security precision: fragmentation and encryption strengthen confidentiality and resilience, but do not alone make a system impossible to alter. Garlip's integrity design should combine these controls with cryptographic verification, controlled reconstruction, access logging and appropriate independent checkpoints. Completeness depends on capture coverage and deployment configuration.

From Activity to Evidence

Make investigations more structured.

When a complaint, incident or audit question arises, teams need a clear route from a business case to the underlying record. Garlip is designed to make that process repeatable.

Identify the case

Search by case, user, application, date, model, trace ID or event category.

Reconstruct events

Review the request, context, model response, agent tools and resulting actions.

Check authority

Inspect permissions, policy versions, approvals, overrides and escalation decisions.

Verify integrity

Run available record-integrity checks and review storage and access history.

Export evidence

Produce a scoped, chronological pack for authorised internal or external review.

Questions for Decision-Makers

Built around practical governance needs.

Audit infrastructure should complement existing controls, not make unsupported promises about regulatory approval or guarantee that every system event is automatically captured.

Does Garlip replace our AI providers?

No. The aim is to add an independent audit and governance layer across supported AI systems. Existing applications and model providers can remain in place.

Can the storage be client-owned?

Yes. The deployment can be designed to use client-owned cloud accounts and storage locations where required, subject to agreed architecture, permissions, key management and operational responsibilities.

Does it capture every agent action?

Garlip is designed to capture model and agent events through supported integrations. Actual coverage depends on where instrumentation is installed, the source platform's logging capabilities and the deployment configuration. Coverage should be tested and documented.

Does an audit trail guarantee FCA compliance?

No single product guarantees compliance. Garlip can support governance, monitoring, investigation and evidence requirements; firms remain responsible for their regulatory obligations, policies and control effectiveness.

Can sensitive records be retained safely?

Capture, redaction, encryption, access, retention and deletion policies should be tailored to the data and applicable obligations. The architecture can be designed around client control and data-minimisation requirements.

Can it integrate with our existing systems?

The API-first approach is designed to connect supported AI applications and agent runtimes with identity providers, case-management, security monitoring, GRC and reporting systems. Specific integrations are confirmed during technical discovery.

Executive Briefing

Make AI activity
auditable by design.

Discuss your AI estate, audit requirements, agentic workflows and preferred deployment model with Garlip. Start with a focused use case and establish the evidence your organisation needs to retain.

Request an Executive Briefing →Technical Enquiry

Garlip AI Audit is positioned as technology to support AI governance, monitoring, investigation and audit. It is not represented as FCA-approved, and use of the platform does not itself establish compliance with any law, regulation or supervisory expectation. Product capabilities and integrations should be confirmed against the specific deployment.