Record AI decisions
Every decision an AI system makes can become a signed event: what kind of decision, the outcome, the reason, the model and its token counts, and a hash of the input and output. The text itself is never stored.
What is stored, and what is dropped
| Stored | Dropped |
|---|---|
Label (nl_query, ml_score, rag_answer), decision (allow, deny, hold, info), reason code, model id, provider, token counts and cost, timestamp, run id, a hash binding input, output and run | The question, the SQL, the features, the answer, the score |
The request
| Field | Meaning |
|---|---|
label | nl_query (a question turned into SQL), ml_score, or rag_answer |
decision, reason | Closed codes. For a SQL guard: allow + guard_passed, or deny + guard_refused |
input, output, run_id | Hashed together (framed) and dropped; run_id is 1-64 token characters |
provider, model_id, input_tokens, output_tokens, cost_micro_usd | Model metadata; counts only |
From Python (the healthcare assistant)
from app import decision_log
# 1) the SQL guard decides, then the decision is recorded
verdict = decision_log.guarded_query(question, sql, run_id="run-2026-11-05-s")
# 2) an ML score (features and score are hashed and dropped)
decision_log.log_score("readmission-risk", features_text=feat, score_text="0.31", run_id=run_id)
# 3) a retrieval answer; no cited source means it is held for review
decision_log.log_rag(question, answer, run_id=run_id, cited=2)Where it records
| Setting | Effect |
|---|---|
ENTROPA_PLATINUM_DIR | Write to a local node directory through the command line |
ENTROPA_PLATINUM_URL | POST to a running node (local or cloud); add ENTROPA_PLATINUM_TOKEN if it is private |
ENTROPA_PLATINUM_REQUIRED=1 | Fail closed: if the event cannot be logged, the query is refused |
| none set | Logging is off; the guard verdict is unchanged |
A logging failure never changes the guard's verdict, except in required mode. The failure reason is kept (
decision_log.last_error()) without any of the submitted text.Over HTTP
curl -X POST $NODE/v1/decision -H "Content-Type: application/json" -d '{...}'Errors are generic and never echo the request. Text that looks like a real identifier (for example a nine-digit number in a valid SSN layout) is refused before anything is hashed.