Don’t trust the AI.
Verify the work.
Everyone has logs. LumenFlow turns every governed action into a tamper-evident receipt that a customer or an auditor can check for themselves — not a claim you have to take on trust.
One action, six steps to a checkable receipt
Every governed action climbs the same ladder before it counts as evidence.
- 1
Work requested
A person or an agent asks for something to happen — a report, a deploy, a customer email.
- 2
Policy applied
The request is checked against the rules and scopes your workspace has set, before anything runs.
- 3
Approval granted
Anything sensitive routes to the right human. Nothing risky executes on the agent's say-so alone.
- 4
Action executed
The agent does the work, inside the scope it was actually granted — not the scope it asked for.
- 5
Evidence sealed
What happened, why it was allowed, and who approved it is written into a hash-chained receipt.
- 6
Customer / auditor verifies
Anyone with the receipts can recompute the chain and confirm nothing in it has been altered.
What actually seals the evidence
Stated at their true posture — what runs by default, what an operator has to turn on, and what's gated to a plan.
Hash-chained receipts
Every receipt's hash commits to its own content and the receipt immediately before it in the same chain. Edit, delete, or reorder one afterwards and every hash downstream stops matching — no configuration required.
Per-workspace Merkle anchoring
Receipts are periodically rolled into an append-only Merkle root scoped to your workspace. Anchors are insert-only — once a root is sealed, nothing inside it can be rewritten, and each new anchor points back at the last.
Operator-keyed receipt signing
Turn on a dedicated Ed25519 key and every new receipt carries a signature that can be recomputed and checked against your public key — the same check an independent auditor runs. Receipts sealed before a key is configured stay hash-chained, just unsigned.
RFC 3161 external timestamp witness
A third-party time-stamping authority — not LumenFlow — attests that a sealed root existed at a specific moment. Until a witness is configured, anchors are honestly recorded as self-sealed and pending, never marked witnessed.
Signed audit export & legal hold
A signed, reproducible export of the evidence stream — labelled a generated artifact, not an attestation — plus an audited legal-hold switch that suspends deletion. Both are gated to the compliance entitlement; neither is on by default.
EU AI Act Article 12 readiness pack
One bundle mapping the audit export, control attestation, and witnessed anchors onto the Article 12 record-keeping obligations — readiness you hand to your own auditor, never a certification LumenFlow issues on your behalf.
What this does not prove
Proof is only useful when its limits are as clear as its guarantees.
- A sealed receipt proves the record wasn't altered after it was written — it doesn't prove the AI's decision was correct, safe, or the right call.
- The external timestamp witness proves a root existed at a given moment — not that every receipt inside it is complete, or that nothing was withheld before sealing.
- Signing is something an operator turns on. An unsigned receipt is still hash-chained and tamper-evident, but carries no independent signature until a key is configured.
- The Article 12 pack and the audit export are readiness material for your own audit — neither is a government certification or a third-party attestation.
Go deeper
The full mechanics, written up for engineers and auditors.
Watch a receipt get sealed
The playground runs real governed actions and shows the evidence receipt as it's written.