Follow the affected work.
Trace supported connections to the decisions, commitments, and actions the incident may have touched.
Understand what happened and what the record can prove.
Bring actions, policy decisions, and source history into one review. Separate what was known at the time from what arrived later.
Start the review with the evidence.
See the decision as the record stood at the time.
A discount approval was given before the invoice went out but arrived in the record afterward. Compare both views without rewriting the earlier history.
Effective dateEvent and sourceEntered the record
- Sep 3
Quote issued at list price, $24,000
The quote records the list price. Discounts above 15% require an authorized reviewer’s approval under the pricing policy.
Sales quote · Q-3121Entered the recordSep 3 - Sep 9
Invoice INV-3121 issued at $18,000
The invoice applies a 25% discount. No approval accompanies it in the record at the time.
Billing system · Customer invoiceEntered the recordSep 9
Known by September 9
The invoice went out with no approval in the record.
The record available when the invoice was issued held the list-price quote and the discount policy. It did not yet include an approval for the 25% discount.
This view establishes what was in the record, not everything a person may have known outside it.
Review packageOrganization scope
A defined window of evidence.
- Period
- September 1–10, 2026
- History
- Receipts and historical context
- Coverage
- Enforced, observed, and not evidenced
- Review
- Integrity information and control mappings
Orcinta Attest
Give the audit a clear scope and a traceable record.
Where Attest is available, authorized reviewers can assemble receipts, reconstruction, and control mappings for an organization or agent within a defined time window.
Share a packet through a shareable verification link that exposes limited verification information and can be revoked. Integrity checks support the review without certifying compliance or completeness.
Explore receipts and verificationKeep the corrective work connected to the incident.
Carry the evidence into the response. Where incident resolution is available, review the scope, interventions, and closure requirements together.
Record who is responsible.
Keep corrective steps, their owners, and their governance decisions on the same evidence trail.
Check what still needs resolution.
Review the underlying finding and required remediation records before a supported closure is confirmed.
A proposed preventive rule still needs authorized confirmation before it can govern future actions.
Explore policiesHave questions?
What can we reconstruct?
Trace recorded actions and decisions to their actors, applicable policies, source evidence, and later outcomes where available. Reviews can cover operational incidents and connected agent activity. The reconstruction depends on source coverage, permissions, and the records captured.
How do you separate earlier knowledge from later evidence?
The record distinguishes when a fact took effect from when it was learned. A historical review can examine what was available at the chosen time, while a later view includes newly received evidence. Corrections preserve the earlier history instead of silently rewriting it.
Does reconstruction establish the root cause?
It helps trace supported connections and identify contributing events. A sequence of events alone does not prove causation or intent. Unknowns, competing explanations, and missing records need to remain visible until evidence resolves them.
What can we establish about an AI agent’s action?
Inspect the recorded actor, request, policy, verdict, and any execution evidence. Actions checked through the governed path remain distinct from activity imported after execution. A permit does not prove completion, and an observed event does not prove prior authorization.
What can we give an external auditor?
Where Attest is available, authorized users can generate an organization or agent-scoped conformance packet for a defined time window. It brings together receipts, reconstruction, governance coverage, integrity information, and versioned control mappings. A shareable verification link exposes limited verification information without giving access to the workspace, and an authorized user can revoke it.
Does a verified packet certify compliance?
No. Verification checks properties of the recorded evidence, including integrity, attribution, and ordering. It does not establish that every event was captured, an action was correct, or a regulatory obligation was satisfied. Control mappings support a review and are not certifications.
How does the record support corrective work?
Where incident resolution is available, authorized teams can record scoped interventions, responsible owners, and remediation decisions on the same evidence trail. Closure checks the underlying finding and required remediation records. Proposed preventive rules require a separate authorized confirmation before they take effect.
Make the next review easier to substantiate.
Connect the event, its context, and the evidence your reviewers need.