Logging & Evidence Flow

Every governance decision produces structured evidence that flows through multiple output channels. In v1.3, this includes cryptographic receipts (TealProof), SIEM-compatible export, and OpenTelemetry spans.

Evidence Pipeline

After every evaluate() call, the following evidence is produced (async, non-blocking):

Output	Format	Purpose	Latency
TEEC Envelope	JSON	Structured decision record with all fields	< 1ms
TealProof Receipt	SHA-256 + Merkle	Tamper-evident cryptographic proof	< 2ms
SIEM Export	JSON / CEF / LEEF	Security operations monitoring	< 3ms
OTel Span	OpenTelemetry	Distributed tracing integration	< 1ms
Response Hooks	HTTP webhook	Real-time alerting on violations	< 5ms

All outputs are async — they don’t block the decision response to the caller.

TEEC v2.0.0 Evidence Envelope

Every decision produces a structured envelope:

{
  "action": "DENY",
  "reason_codes": ["NHI_SCOPE_VIOLATION"],
  "risk_score": 85,
  "automation_level": "auto_deny",
  "correlation_id": "req-7f83b165",
  "timestamp": 1716000000000,
  "teec_version": "2.0.0",
  "policy_version": "3.2.0",
  "control_id": "NHI-003",
  "owasp_category": "ASI-07",
  "nhi_identity": {
    "agent_id": "support-bot-001",
    "owner": "[email protected]",
    "lifecycle_state": "active"
  },
  "proof": {
    "decision_hash": "sha256:7f83b165...",
    "merkle_root": "sha256:abc123...",
    "leaf_index": 847
  }
}

Redaction

All evidence passes through redaction before output:

Redaction Mode	What’s Redacted	Use When
`metadata-only`	All content removed, only metadata kept	Production (recommended)
`hash-only`	Content replaced with SHA-256 hashes	Need verification without storing content
`partial`	Only PII/secrets redacted	Development/debugging

Default: metadata-only — no raw prompts, completions, or PII in production logs.

SIEM Export

Governance events are exported in security operations formats:

Format	Standard	Use With
JSON	Structured JSON lines	Splunk, Elastic, Datadog, custom
CEF	Common Event Format	ArcSight, QRadar
LEEF	Log Event Extended Format	QRadar

Each event includes: timestamp, decision outcome, reason codes, policy version, agent identity, action type, risk score, and correlation ID.

// Configuration
response_hooks: [{
  id: 'siem-export',
  trigger: 'always',
  endpoint: process.env.SIEM_WEBHOOK_URL,
  format: 'json',
  dedup_window_ms: 60000,
  rate_limit: { max_per_minute: 100 },
}]

OpenTelemetry Spans

Every governance evaluation emits an OTel span:

Attribute	Value
`tealtiger.decision.action`	ALLOW / DENY / PENDING / MODIFY
`tealtiger.decision.risk_score`	0–100
`tealtiger.policy.version`	Policy version string
`tealtiger.agent.id`	Agent identity
`tealtiger.correlation_id`	Request correlation ID
`tealtiger.modules.evaluated`	List of modules that ran
`tealtiger.reason_codes`	Comma-separated reason codes

Span name: tealtiger.governance.evaluate

TealProof Receipts

Every decision is appended to a Merkle tree:

Compute decision_hash = SHA-256(decision + context + timestamp + policy_version + prev_hash)
Append to Merkle tree as a new leaf
Periodically anchor Merkle root to RFC 3161 TSA (every 1000 decisions or 5 minutes)

This creates a tamper-evident chain — if any historical decision is modified, the Merkle root changes and verification fails.

Response Hooks

Webhooks fire on specific triggers with deduplication and rate limiting:

Trigger	When It Fires
`policy_violation`	Any DENY decision
`high_risk`	Risk score > configurable threshold
`freeze_tamper`	FREEZE_TAMPER_ATTEMPT detected
`always`	Every evaluation

Hooks include retry policy (configurable backoff) and deduplication (suppress repeated violations within a window).

Correlation

All evidence outputs share the same correlation_id (UUID v4), enabling cross-system correlation:

Application logs → correlation_id
Governance decision → correlation_id
SIEM event → correlation_id
OTel span → correlation_id as trace attribute
TealProof receipt → correlation_id in decision hash

This means a single agent action can be traced from application code through governance evaluation to SIEM alert to cryptographic receipt.

TEEC Evidence Contract

Full envelope schema (v2.0.0)

SOC/IR Pipeline

SIEM integration details

TealProof

Cryptographic receipts API

Configuration

Audit and hook configuration

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Evidence Pipeline

TEEC v2.0.0 Evidence Envelope

Redaction

SIEM Export

OpenTelemetry Spans

TealProof Receipts

Response Hooks

Correlation

TEEC Evidence Contract

SOC/IR Pipeline

TealProof

Configuration

​Evidence Pipeline

​TEEC v2.0.0 Evidence Envelope

​Redaction

​SIEM Export

​OpenTelemetry Spans

​TealProof Receipts

​Response Hooks

​Correlation

​Related Documentation

TEEC Evidence Contract

SOC/IR Pipeline

TealProof

Configuration

Evidence Pipeline

TEEC v2.0.0 Evidence Envelope

Redaction

SIEM Export

OpenTelemetry Spans

TealProof Receipts

Response Hooks

Correlation

Related Documentation