Append-only, hash-chained
Edits, deletions and gaps break the chain. Database triggers stop the application role from updating or deleting audit rows.
Every prompt, tool call and approval is written to a hash-chained, tamper-evident log. Sensitive tools wait for a human. Hand your auditor an export they can verify themselves.
pip install oleusfrom openai import OpenAI from oleus.llm import wrap_openai, OleusHeld client = wrap_openai(OpenAI(), "gr_live_...", agent_id="support-agent") # "refund" is sensitive: raises OleusHeld until an admin approves client.chat.completions.create(model="gpt-4o", messages=[...])
from oleus.llm import gateway client = OpenAI(api_key="sk-...", **gateway("gr_live_...", "openai", "support-agent")) # or: OPENAI_BASE_URL=https://api.oleus.io/gateway/openai/v1 # your provider key is forwarded, never stored
Two ways in, one tamper-evident log, and evidence an auditor can check without trusting us.
Wrap your OpenAI or Anthropic client, or point it at the Oleus gateway. Each call becomes a log entry: agent, model, tokens, tool calls, risk flags and SHA-256 hashes of the prompt and completion. Raw content is never stored.
Tools like refund, delete and execute_sql are held until an admin approves. Approvals are bound to one agent and tool, single-use, and expire after 15 minutes. The approver comes from the session, not the client.
Each entry commits to the one before it. /agent-audit/verify recomputes the chain, and a daily chain head is written to S3 Object Lock. Export CSV with sequence numbers and hashes for your auditor.
Edits, deletions and gaps break the chain. Database triggers stop the application role from updating or deleting audit rows.
Daily chain heads go to S3 Object Lock in compliance mode, so truncating the tail of the log is caught.
Only SHA-256 hashes leave your process. PII and secret flags are computed client-side and labelled client-asserted.
Pass strict=True to the SDK, or use the gateway: a call that cannot be recorded is not returned.
SSO (OIDC), SCIM, enforced MFA, IP allowlist and custom roles for who can approve, export and administer.
The backend needs only Postgres. Enterprise runs in your own infrastructure with Docker Compose.
Filter and export by control. Oleus Audit produces evidence for your audit; it does not make you SOC 2 compliant or certified.
| Control | What it covers | Evidence from Oleus |
|---|---|---|
| CC6.1 | Logical access | Tool calls, who approved them, blocked attempts without approval |
| CC7.2 | Monitoring | Every recorded LLM call and tool call with risk score and flags |
| CC8.1 | Change management | Policy changes and approval decisions, with timestamps and approver |
"Every call" is true when agent traffic goes through the Oleus SDK wrappers or the gateway, with direct provider egress blocked. Tamper-evident is not tamper-proof: a database owner can still alter rows, and anchoring makes that detectable.
No. It produces evidence mapped to CC6.1, CC7.2 and CC8.1. Compliance comes from your own audit.
No. SDK users send only SHA-256 hashes. Gateway traffic passes through memory to compute hashes and flags, then is discarded.
Each entry includes the hash of the previous one and chain heads are anchored to S3 Object Lock, so edits, deletions and gaps are detectable. It does not claim the data cannot be altered.
Not yet. A Type I audit is planned. See the security page for current status.
The SDK keeps content in your process. The gateway needs no code changes beyond a base URL and covers any language. Both write to the same log.
Yes, on Enterprise: Docker Compose on your own Postgres. Learn more.