Verify Audit Records with Trail

Trail is the audit log of the control plane. It records each change to a resource, the actor, and the result, in a hash chain that you can verify. This article explains what Trail contains and how to prove its records. Trail and Audit Evidence gives the full procedure.

Know what Trail records

Trail records control-plane actions only. Other evidence is in different places:

Where	Evidence
verdictan events or GET /v1/events	Runtime decisions and request policy activity
History	Captured prompts and responses, when capture is on
Inbox	Human review items and their decisions
Trail	Control-plane actions, resource changes, audit chronology, and record integrity

Trail records the operation, not the final state. After a successful request, examine the resource on its own detail page.

Verify the record integrity

Sign in to the CLI with an account that can read Trail for the organization. Then use your own organization ID and dates:

verdictan trail verify \
  --org-id <org-uuid> \
  --start-time 2026-07-01T00:00:00Z \
  --end-time 2026-07-08T00:00:00Z \
  --deep \
  --json

• Without --deep, the command examines the stored digest links in a window that is not empty.
• With --deep, the command calculates each record hash again. It also examines the sequence numbers and the previous-hash links.
• With --event-id <id>, the command examines only the recorded hash of that event.

The command exits with a nonzero status for a hash or link mismatch, a sequence gap, or an empty window. If a verification fails, keep the full JSON output. Do not report the result as verified.

Keep the records for longer than 90 days

Verdictan keeps each Trail event for a maximum of 90 days. Then it deletes the event. You cannot change this limit.

To keep Trail events for a longer time, use one of these methods before the events are 90 days old:

• Forward the events to a SIEM.
• Export them with verdictan trail export.

The lookup and export commands accept a window of a maximum of 7 days. verify --deep accepts a maximum of 90 days. Divide a longer range into more than one window.

Next steps

• Trail and Audit Evidence: search Trail, read a record, and export it.
• verdictan trail: each option of lookup, verify, and export.
• Export Evidence for a Review: download decision events for a reviewer.