Skip to content

Platform · Evidence

Prove what happened, to anyone who asks

Regulated firms are asked to show, not tell. Every decision, approval and release lands in a tamper-evident logbook that an auditor can check — with reporting your risk committee can read.

Part of GREENLIGHT

Why it matters

The problem Evidence solves

When a regulator, auditor or customer asks why an agent did something, application logs rarely answer it. Evidence keeps a record of each decision that you can explain, report on and verify, without asking anyone to take your word for it.

Questions it answers

  • Why did this action get this outcome?
  • Can someone outside the company verify the record?
  • How do we report agent activity to a committee or our SOC?

Where it sits

Evidence in the GREENLIGHT loop

Every consequential action moves through the same loop. Evidence from each decision informs the next policy.

How it works

Evidence, step by step

  1. 01

    Record every decision

    Requests, decisions, approvals and releases go into a tamper-evident logbook.

  2. 02

    Explain it

    The decision explorer shows why an action received its outcome.

  3. 03

    Verify it

    Signed checkpoints let an auditor check the record offline.

  4. 04

    Share it

    Reports for committees, exports for retention and events for your SIEM.

What’s included

The 4 modules of Evidence

Evidence · 01

Audit logbook

A tamper-evident record of every decision, approval and release. Any later edit breaks the record — and shows.

  • Decision explorer: why this action got this outcome
  • Replay the decision, not the logs
  • Separate administrative audit trail

Evidence · 02

Verifiable evidence

Signed checkpoints let an auditor verify the record offline, without having to trust Crelis, and evidence can be exported to write-once storage.

  • Offline verification tooling
  • Evidence exports
  • Write-once retention options

Evidence · 03

Analytics & reporting

Volume, outcomes and trends over 14, 30 or 90 days, coverage of what your agents actually do, escalation SLAs and redacted reports.

  • Analytics Studio
  • Governed-surface coverage
  • Redacted reports for committees and auditors

Evidence · 04

SIEM export

Stream decisions and approvals into your existing detection and response stack.

  • Structured events
  • Your SOC sees every agent action
  • No new console to watch

In practice

Answering a complaint

A customer disputes a refund that was declined. The team opens the decision in the logbook, sees the rule and reason, and shares a redacted record instead of reconstructing events from logs.

Illustrative scenario.

Use case

Payments & refunds

Who uses it

  • Risk & compliance report to committees
  • Internal and external auditors verify the record
  • Security operations watch agent activity in the SIEM
  • Answers, not logs

    Each decision comes with its reason and the rule behind it.

  • Verifiable by others

    The record can be checked without trusting Crelis.

  • Fits your stack

    Exports and SIEM events go where your teams already look.

See it working

See Evidence on your own workflow.

We connect one agent workflow in shadow mode and walk you through every decision GREENLIGHT would make, so you can judge it on your own traffic.