00/Use case · Enterprise
SAML and OIDC SSO, SCIM 2.0 provisioning, tamper-evident audit, per-agent action logs. EU AI Act Article 13 transparency, SOC 2 CC6.1 least privilege, ISO 27001 A.9.4 access control. Map the controls to the product, not the other way around.
01/TL;DR
Audit logs, access reviews, and provisioning records generate themselves. Your compliance team queries them. No parallel system of record.
Every autonomous action carries a parent user, a scope, and an outcome. The evidence regulators want for AI systems is the evidence you already have.
Deploy into your VPC, your Cloudflare account, or your on-prem Kubernetes. Data residency, key custody, and break-glass operations are configurable.
02/The problem
Enterprise teams end up running two audit pipelines. One from the auth vendor. One from whatever agent framework the product team shipped. When the AI oversight board asks 'which autonomous system touched the payroll file on March 19th at 14:22', neither log has the answer on its own.
Vendor audit covers humans only
Auth0 and Okta log human logins and admin changes. When an agent invokes a tool, the audit line says 'service account'.
Framework audit is ad hoc
LangChain, CrewAI, and custom orchestrators log to stdout or a custom table. No tamper evidence, no retention policy, no SIEM integration by default.
EU AI Act Article 13 is hard to answer with either
The statute asks for transparency on autonomous system decisions. Answering requires joining human audit with agent audit, and the join key usually does not exist.
Procurement blocked on SOC 2 timeline
Enterprise buyers want SOC 2 Type II, ISO 27001, and a tamper-evident audit log before they sign. Delay on any of those is a deal delay.
03/How kavachOS fits
KavachOS treats humans, agents, and service accounts as subjects in a single graph. Delegation connects them. Audit covers the whole graph with the same evidence format. Compliance controls map to primitives, not to a parallel reporting layer.
Audit
Identity
SSO
Residency
Controls
04/In code
Full examples with framework adapters live in the docs. This is the shape of what you wire into your app.
audit-query.ts
Pull every autonomous action that touched a specific resource during an audit window. One query, joined across human and agent subjects.
import { kavachos } from "kavachos";
const events = await kavachos.audit.query({
resource: "payroll:march-2026",
from: "2026-03-19T00:00:00Z",
to: "2026-03-19T23:59:59Z",
subjectType: ["human", "agent"],
include: ["parentChain", "scope", "outcome"]
});
// Each event carries subject, parentChain, scope, resource,
// outcome, signedHash. Export for your auditor or stream to Splunk.
for (const e of events) {
console.log(e.timestamp, e.subject.id, e.parentChain, e.outcome);
}SOC 2
Type I at launch, Type II in flight
ISO 27001
Controls mapped and evidenced
EU AI Act
Article 13 coverage native
Hash-chained
Tamper-evident audit log
05/Before / after
Without scoped identity
With kavachOS
Our regulator asked for the autonomous-action audit for a one-hour window across three services. In the old stack that was a week of ad hoc SQL. With KavachOS it was a ten-minute query.
06/FAQ
Short answers. Link out to the docs if you want the long version.
07/Related reading
On kavachos.com
Our security model, encryption choices, and disclosure timeline.
On kavachos.com
How KavachOS audit maps to the statute, with example queries.
On kavachos.com
Enterprise pricing, compliance coverage, and agent audit compared.
Bring your control catalog. We map the features, show the queries, and provide the evidence bundle your auditor actually wants.