BlackLake for Operations & GRC
Audit-ready evidence for AI-operated work.
When auditors ask “which AI actions were authorized, by whom, and at what cost?”, the answer has to come from a record the AI didn’t generate itself. BlackLake is the system of record — independently verifiable, exportable to your SIEM, ready for GRC review.
The problem
GRC frameworks were built for human actors. AI changes the model.
SOC 2, ISO 27001, and similar frameworks assume the entities taking consequential actions are humans who can be held accountable through access controls and change management. AI Actors break that assumption — their marginal action cost is fractions of a cent, their volume is unbounded, and they can claim compliance without ever invoking governance.
BlackLake extends governance infrastructure to AI work. Every consequential AI action flows through the same policy, approval, and receipt model as any other governed operation. The ledger that produces evidence is independent of the AI generating it.
Capabilities
Evidence infrastructure for AI-operated organizations
Audit-ready evidence on demand
Every governed AI action produces a signed record. Export the full ledger as NDJSON for SIEM ingestion or CSV for finance. Both formats are HMAC-signed with the workspace chain.
Receipts customers can verify themselves
Decision tokens are independently verifiable. Anyone — including your auditor — can paste a receipt into /verify and confirm the outcome without workspace access.
Signed exports for BigQuery and SIEM
Stream the AI ledger to BigQuery or your SIEM. Signed NDJSON exports feed Splunk, Datadog, and any standards-compliant log ingestion pipeline.
Policy snapshot bound at decision time
Every receipt binds the policy snapshot that was active at decision time. An auditor reading a six-month-old receipt sees exactly which rule applied — even if the policy has since changed.
Anomaly detection and baselines
Baselines track normal AI activity patterns. Anomalies surface deviations — an agent calling an unusual tool, a cost spike, a new capture path — before they become audit findings.
Complete capture across all AI work
IDE, CI, shell, cloud, SDK, and durable workflows all feed the same ledger. Coverage shows which actors are governed and which are observed but uncontrolled.
Build your AI evidence chain today.
Free while in beta. Signed receipts, SIEM exports, and audit-ready evidence from the first governed action.