Audit Trail for AI-Generated Code

When an agent opens a pull request, edits a ticket, or cuts a release, the question an auditor asks is the same one a security reviewer asks after an incident: who approved this, and what did it touch?

Most teams reconstruct that answer after the fact, pulling PR history from one tool, comments from another, and timing from CI. The reconstruction is slow, and it depends on every tool having kept its own side of the story.

Modulo records the story as the run happens.

What gets recorded

Every governance event in a run writes to an audit log: the trigger that started it, each agent dispatch, each node's input and output, every gate outcome, every human decision, and the final artifact. Each event carries an actor, an action, a resource, and a timestamp.

The log is append-only and hash-chained. Every event stores a SHA-256 link to the event before it, so changing or removing one event breaks the chain. The audit view verifies the chain on demand and exports the log for a review. See the architecture for the audit-logger layer.

Alongside the log, every run produces a versioned snapshot: the input, all intermediate outputs, the final artifact, and the prompt and model versions used. Because the snapshot is versioned, a later schema or prompt change leaves the record of an earlier run untouched. See Pipelines for snapshot replay, comparison, and JSON export.

Prove who approved what

Human-in-the-loop (HITL) gates pause a run before a risky step. A reviewer claims the gate with a short-lived claim token, inspects the artifact with the full upstream context attached, and approves or rejects. The decision, the approver's identity, and the timestamp land in the audit chain. See Human-in-the-Loop.

The result is a chain of custody from prompt to production: which agent produced the change, what it was asked to do, which checks ran, who signed off, and what shipped.

Where the record lives

The audit log and snapshots are stored in your own Postgres, inside your Modulo instance. Modulo is self-hosted and leaves telemetry off by default, so the record stays on your infrastructure. See What is Modulo.

Coverage follows the pipeline

An agent action that runs inside a Modulo pipeline is recorded end to end. Work an agent does entirely outside the pipeline keeps whatever record its own tool provides, which is the reason to route agent work through the pipeline rather than around it.

Where to go next

• Human-in-the-Loop: the gate workflow and the claim model
• Pipelines: snapshots, replay, and export