A log you control is not evidence. A log the vendor controls is not evidence either. Evidence is a record that a third party can check without having to trust whoever produced it.
What you get
Every governed call produces a record: which agent acted, on whose authority, what was decided, and the outcome. Never a secret or a message body.
That record is signed and tamper-evident. Anything altered, removed or inserted after the fact shows up as a failed check, and the check is one you run yourself rather than one KPATH runs for you.
The record is streamed to your SIEM as it happens and exported for retention. Once it is on write-once storage you control, neither you nor KPATH can quietly change it.
What you can prove
KPATH provides a verifier and a sample export, on request or as part of a pilot. The verifier runs locally and reports whether a record is intact. The sample export covers a known scenario, including a chain stop, so you can see what a valid record and a tampered one each look like before you run the check on your own data.
Steps
Get the sample export
Ask us for the sample audit record. It is small and self-contained, so you can try the check before you point it at anything of your own.
Get the verifier
Get the verifier alongside it. It runs on your own machine and needs no connection to KPATH, which is also what makes the check work in an air-gapped environment.
Run it against the sample
Run the verifier over the sample export and read what an intact record looks like, then over the tampered sample and read what a failed check looks like.
Export your own record and run it again
Take an export from your own write-once storage and run the same verifier over it. Nothing about the check changes, and no part of it goes through KPATH.
Read the result
An intact result means nothing has been altered, removed or inserted since the record was written. A failed result names where the check broke. Either answer was reached without KPATH’s console and without trusting KPATH.
What this gives an auditor
The auditor can answer, from the record alone, which agent did what, on whose authority, and whether the decision was allow, refuse or wait for approval. After a chain stop, the same record shows that nothing in the chain was authorised after the stop, which is the containment proof described on whole-chain containment.
The auditor does not need to trust KPATH’s console, KPATH’s operators or KPATH’s account of events. That is the difference between a log and evidence, and it is the Prove step of the Verify-Enforce-Stop-Prove test.