The sovereignty that justified an on-premises AI deployment ends wherever its inspection traffic and logs go. An enterprise that moved inference on premises so sensitive data never leaves the perimeter, then routes prompts to a vendor cloud for security scoring or ships session logs to a hosted analytics platform, has moved the protected data into the inspection pipeline instead of the inference pipeline. Inspection happens at the deployment's own chokepoints, and the record stays under the same governance as the data.
Evidence as a byproduct of enforcement
A well-built deployment generates its evidence as a side effect of its controls: the declaration says what the agent was authorized to do, the session record says what it did, boundary denials say what it attempted, asset wrappers log every touch, and credential substitutions mark every authenticated outbound call. Collected deliberately, these answer the two questions every examiner, auditor, and incident responder asks: what was this agent allowed to do, and what did it actually do. Joint agency guidance names accountability among its five agentic risk categories for exactly this reason; agentic systems make decisions that are hard to inspect and produce logs that are hard to parse, so evidence has to be designed in advance rather than scraped together afterward.
The record, field by field
| Field | What it answers |
|---|---|
| User, endpoint, process | Who and where, at the machine level |
| Agent identity, version, and identity provenance | Which agent, attributably, and how confidently it was identified |
| Model artifact hash | Exactly which model produced or drove this |
| Configuration version | Which skills, servers, and instruction files were in effect |
| Project and policy version | Which boundary and which rules governed the decision |
| Action and decision | What was attempted, and what the deployment decided |
| Policy rule and result | Which rule fired, and the enforcement outcome |
| Content-depth mode | What this record retained, so the record describes itself |
| Containment or exception state | Whether the agent was under quarantine, break-glass, or normal policy |
| Enforcement point | Where the decision was made |
| Timestamp and trace ID | When, and how to follow the chain |
The hash and version fields are what make the record actionable later: they are how a model recall finds its affected population and how an investigation distinguishes a model problem from a configuration problem.
Four properties of evidence-grade
Attributable: every record ties to a verified agent identity. Tamper-evident: logs are written to storage the agent has no path to, then protected with append-only storage, integrity checks, and restricted administration. Governed: retention, access, and residency follow the same rules as the underlying data, because a log of prompts about customer accounts is customer data. Proportionate: capture enough to prove and investigate the decision without creating a second unmanaged copy of every sensitive prompt and response.
Choosing the depth
| Mode | What is retained | When it fits |
|---|---|---|
| Metadata only | The full record schema, no content | High-sensitivity data classes where the log must not hold the data |
| Redacted content | Schema plus content with sensitive classes masked, plus keyed hashes (HMAC), since a plain hash of a low-entropy value can be guessed offline | The default for most governed projects |
| Full content | Everything, including prompts and responses | Investigations, regulated workloads that require it, short retention |
Depth is configurable by project and data class, and the evidence system must not recreate the exposure the on-premises deployment was built to avoid. Access to content-bearing records is its own control: restricted by role, logged when exercised, and gated by a break-glass procedure with a second approver for the highest-sensitivity classes, so any access to the evidence is itself recorded.
Coverage, honestly stated
Completeness is a claim about the governed paths, so the deployment states which paths those are; traffic that bypasses the inspection point produces no record. And the self-hosted obligation deserves stating bluntly: with a hosted provider there was always a second set of logs somewhere. Self-hosted, there is no vendor to ask: if your deployment did not record it, no record exists anywhere.
Where the control plane fits
Ensage AI keeps inspection and evidence local: agent sessions are inspected inline at the AI Session Controller, a TLS-terminating proxy inside the customer's perimeter, and zCenter holds policy versions, decisions, and session records, with depth set per project, under customer custody.
