1,509 rows, zero denials
That is the log one team showed their auditor. Every row said allowed. The auditor asked the only question that matters: show me a refusal.
A log without denials cannot prove that anything was ever stopped. It proves traffic, not control. Deny evidence is the opposite artifact: every refusal, signed, chained, and readable by someone who does not trust your dashboard.
“1,509 lines, all allowed, not a single denial — and that is exactly what they ask for.”
What a deny record contains
{
"v": 1,
"prev": "<sha256 of the previous record>",
"ts": "2026-10-29T09:14:02+00:00",
"decision": "deny",
"reason": "payee not in allowlist",
"policy_id": "E03-allowlist",
"task_id": "task_7f21",
"artifact_hash": "sha256:9c1e…",
"actor": "agent:research-1",
"meta": {"requested_amount": "12.50", "allowed_max": "0.05"},
"hash": "<sha256 of this body>",
"signature": "<Ed25519 signature>",
"public_key": "<base64 key>",
"algorithm": "ed25519"
}API in two calls
# record a refusal
curl -X POST https://attest.rta.lat/deny \
-H 'content-type: application/json' \
-d '{"reason":"payee not in allowlist","policy_id":"E03-allowlist",
"task_id":"task_7f21","artifact_hash":"sha256:9c1e","actor":"agent:research-1"}'
# read refusals since a moment
curl 'https://attest.rta.lat/deny?since=2026-10-29T00:00:00Z&limit=100'What it proves — and what it does not
| Proves | Does not prove |
|---|---|
| The record was not changed after issue | That no other chain was shown to someone else |
The chain has no gaps (each prev matches) | That every refusal in your system reached this log |
| The signature verifies offline with the embedded key | That the policy behind the refusal was correct |
$29 / month · unlimited deny records · signed export · 30-day retention
Start — pay $29 in USDC