The Auditable AI Ecosystem
Open-source infrastructure for auditing AI agents, from before deployment to after a run.
Open artifacts, each answering a question an auditor asks about an agent or the evidence it leaves.
The record they produce has two uses: it shows what a system did wrong, and it shows what it never
needed to do. Every released one is public and citable, and the tools install from PyPI.
This page covers the auditing-of-action arm of the lab's work and says where each piece applies.
The research argument behind it is on the home page. For the
detection-in-data arm, see PyOD. For the sourced adoption record across
every project, see open source.
Start with Your Task
- Review Python agent code or deployment configuration:
start with Agent Audit for source-linked security findings.
- Check a proposed tool call before execution:
start with AEGIS for policy checks and approval decisions on the tool path.
- Evaluate skill and tool selection for least privilege:
start with FORTIS for benchmark tasks, scoring, code and citation.
- Decide what evidence an agent system should retain:
start with Auditable Agents and its Auditability Card.
- Check a claim about an agent:
start with Auditable Claims about AI Agents for the records and decision rule a claim needs before a verdict.
pip install auditable
For dependency records and replay, explore the auditable SDK and its documented
examples. For the research framework behind the lifecycle view, read
Auditable Agents
before choosing an auditing mechanism.
Where Each Piece Applies
An agent can be checked at three moments, and the evidence available differs at each. Before a run
you have the declared configuration and the code. During a run you have the call about to fire.
After a run you have whatever the trace preserved. Each artifact below sits at the moment where its
evidence exists, and appears once.
Pre · Before Deployment
Does this agent ask for more than it needs?
A static scan of agent code for security and over-privilege issues, run before anything ships.
Does the agent stay inside the skill it was given?
A benchmark for over-privilege in agent skills: whether a model selects the minimally
sufficient skill and selects tools within that skill's documented scope.
The benchmark evaluates choices without executing tools against live backends.
Live · While Running
Can this call be stopped before it fires?
A pre-execution firewall that gates each tool call while the agent is running.
Do agents serving different owners respect each other's boundaries?
A sandbox and benchmark for multi-party tool use across personal agent workspaces.
It records messages, tool calls, resource operations, and final workspace state, and
reports task utility and attack success separately.
Is one user's data reaching another?
Measures leakage across users in agents that share state.
How much memory leaks between agents?
Memory leakage in multi-agent LLM systems, measured against the topology that connects them.
Post · After a Run
What did this decision rely on, and can it be undone?
A framework-agnostic system of record that captures each decision's dependencies, replays them
against live state, and rolls back the committed action when they no longer hold.
How can agent steps and their dependencies be represented?
A typed two-layer graph of agent execution and dependency, with dependency edges
graded by how they are known. The representation is reused by auditable.
Who caused this, when the logs are gone?
Recovers segment-level attribution in a multi-agent run from the final text alone.
Foundations
These artifacts apply at all three stages. They define auditability, specify the evidence for a
claim, assess the risk of an agent change, read agent datasets and traces into common records,
measure whether a failure was catchable, and map the surrounding literature.
What does auditability actually require?
Five dimensions and three mechanism classes: detect, enforce, recover. The grid above is that
framework instantiated.
What records would settle this claim?
Extends Auditable Agents' Policy Checkability from single actions to claims.
Fix the policy, scope, records, writers, and decision rule before a verdict.
Six claim checks and an illustrative case connect the evidence to supported, contradicted, or undecidable verdicts.
What risk can existing logs establish before an agent changes?
Separates episodes that act as logged, stop under a declared valuation, or continue and need further evidence.
Gives conditions for exact replay and identifies the records, saved states, and targeted reruns needed for a decision.
Replay assumes unchanged components remain invariant and the agent does not anticipate the change.
How do agent runs from different sources reach the same analysis?
Reads 13 public agent trajectory datasets, trace files, and live runs into ATIF v1.7 records
that keep what each source recorded. The records go to pandas tables, networkx graphs, or
OTLP spans for a tracing UI.
Was the failure catchable at all?
Puts one auditor's question to all three information states under a single interface. It scores
72 entrants over 1187 declared configurations and 1162 recorded runs, and publishes the 71
contrasts that fail to separate rather than ranking them.
The
56 authored synthetic PRE records are MIT licensed; third-party records have separate or unresolved terms in the
license notices.
Who else is working on this?
A curated map of papers, tools, datasets, and standards for reliable, auditable AI agents,
with published checks for paper-title and destination consistency.
Build on It
Every released artifact here is public, citable, and built to be extended. If you are adding a detector, a
policy, or a new lifecycle stage, open an issue on the repository it belongs to. If you are
benchmarking against this work, CatchBench
is the entrant interface, and it takes submissions that fail to separate as readily as ones that win.
Most of this stack lives under
github.com/yzhao062.
agent-audit, Aegis, and WeClawArena are
maintained in their authors' own repositories, linked above.
