ClovieA record of what every agent did, and why it was allowed.
Follow any agent request by request: prompts, answers, models, tools, cost and every policy decision. Hand auditors signed evidence packs, and stream the same records to the tools your security and data teams already use.
Activity
| Agent | Policy | Decision |
|---|---|---|
| Card Dispute TriageAccount number in prompt | Keep account numbers out of prompts · v3 | Deny |
| AML Alert Investigatorbsa:sar permission present | Keep SAR tools with BSA agents · v2 | Allow |
| Mortgage Underwriting AssistantWire transfer started by agent | Approve money movement · v4 | Require approval |
| IT Service Desk Botgpt-4.1-mini is allowed | Only reviewed third-party models · v1 | Allow |
| Advisor Co-pilotReview date has passed | Reviews are not overdue · v2 | Would deny |
Uptime dashboards don’t answer an auditor’s questions.
Logs without decisions
Request logs show that a call happened, not which policy allowed it or why.
Evidence by screenshot
Audit preparation means weeks of exports, screenshots and spreadsheets.
Records in silos
Security, data and compliance teams each want the records in their own system.
Clovie records the decision with the request, keeps an immutable trail and makes every record exportable, so evidence comes from what happened rather than from what someone remembered.
One trail from request to audit, exported wherever your teams already look.
See it at work
Audit log
| Time | Agent | Model | Decision |
|---|---|---|---|
| 14:02:11 | Card Dispute Triage | gpt-4o | Deny |
| 14:01:58 | Fraud Alert Triage | claude-sonnet-4.5 | Allow |
- Policy
- Card numbers stay out of prompts
- Mode
- Enforcing
- Reason
- Card number found in the prompt
- Provider call
- Not made
Evidence pack
- Agent
- Card Dispute Triage
- Decision
- Deny
- Policy version
- v3, enforcing
- Recorded
- 14:02:11 UTC
What you get
Agent runs and traces
Every request with its prompt and answer, the model requested and the model used, tool calls, child calls from sub-agents, duration, usage, cost and policy steps.
Audit log
Every policy decision with the agent, the policy version, the decision and the reason.
Change log
Who changed which governance setting, with the values before and after.
Security events
Sign-ins, role and membership changes and administrative changes, in a separate log.
Signed evidence packs
Choose a period of up to 90 days and a framework; packs carry checksums and signatures an auditor can verify.
Stream to your SIEM
OTLP over HTTP or gRPC, Splunk HEC, Datadog, webhooks, syslog and AWS Security Lake in OCSF.
Also in this layer
| Capability | What it does |
|---|---|
| Data lake export | Compressed JSON lines to S3, Cloud Storage or Blob Storage, written once with checksums for object-lock buckets. |
| Incidents and feedback | Track AI incidents with root cause, collect ratings on runs and turn bad answers into eval cases. |
| Retention you control | Choose whether prompts and responses are stored and for how long; sensitive data is masked first. |
Controls mapped to the frameworks you answer to
- SOC 2: SOC 2 Type II trust services criteria
- NIST AI RMF: NIST AI Risk Management Framework
- EU AI Act: EU Artificial Intelligence Act
- ISO/IEC 42001: ISO/IEC 42001 AI management system
- OSFI E-23: OSFI Guideline E-23, model risk management (Canada)
Runs wherever Clovie runs
- SaaS
- Customer VPC
- On-premises
- Air-gapped
Every record stays in your database in self-hosted modes. Datadog export isn’t available in air-gapped installs; syslog is self-hosted only.
Questions
Can audit records be changed?
Not from the product. Audit records can’t be edited or deleted, and evidence packs can be verified independently.
Do you store prompts and answers?
Only if your administrators choose to, for as long as they choose. Sensitive data is masked before storage.
Which frameworks can an evidence pack cover?
SOC 2 Type II, NIST AI RMF, the EU AI Act, OSFI E-23 and ISO/IEC 42001.
Can we see traffic from gateways that aren’t Clovie’s?
Yes. Calls reported by connected gateways appear in agent runs, labelled with the gateway that observed them.
Don’t wait for the incident report to find out what happened.
See observability and audit on your own agents, in the deployment you need.