signed-audit-trails-recipe

Policy-gated execution evaluates each AI tool call against a Cedar policy before it runs. This mechanism ensures that only authorized actions execute, preventing non-compliant agent actions in regulated CI/CD pipelines. It serves as a prerequisite check before generating signed audit receipts.

Yes, you can verify tamper-evident audit receipts offline within a CI/CD pipeline. The Skill uses Ed25519 signing and hash chaining to generate receipts that survive beyond the live session. This supports multi-party review workflows and build provenance without requiring continuous network access.

Yes, securing Claude Code tool calls requires Cedar policy checks for execution gating and JCS canonicalization for consistent data serialization. These components, alongside Ed25519 signing, ensure that audit trails remain cryptographically secure and verifiable. This setup is designed for regulated operations.

The best way to prove agent actions were not altered is by generating tamper-evident audit receipts using Ed25519 signing and hash chaining. This creates a cryptographically secure, sequential record of AI tool calls. Offline receipt verification allows auditors to validate build provenance independently.