doc /audit/docsrev v1.2 · april 2026status stable·integrate < 30 min

six chapters. one source of truth.

installation, authentication, ingestion, verification, proof retrieval. the bytes on the wire, the schema, and the source-system mapping. read it end to end, or jump to a chapter.

§01overview

syen comply is a cryptographic audit ledger for ai decision systems. it records every ai action, human approval, and automated decision as a tamper-evident entry that is independently verifiable by auditors, regulators, and courts.

this guide covers installation, authentication, event ingestion, chain verification, and proof retrieval. a complete integration for a new event type takes under thirty minutes.

§02prerequisites

§03installation

no custom sdk required. use the standard python requests library:

pip install requests

§04authentication

authenticate with the api to receive a bearer token. all subsequent requests use this token.

curl

curl -X POST https://api.syensystems.com/api/v1/attest \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "your-tenant-id",
    "agent_id": "your-agent-name",
    "agent_code_hash": "sha256-hash-of-your-agent-code"
  }'

# Returns: {"token": "Bearer ..."}

python

import requests

resp = requests.post(
    "https://api.syensystems.com/api/v1/attest",
    json={
        "tenant_id": "your-tenant-id",
        "agent_id": "your-agent-name",
        "agent_code_hash": "sha256-hash-of-your-agent-code"
    }
)
token = resp.json()["token"]
headers = {"Authorization": f"Bearer {token}"}
note: agent_code_hash should be the sha-256 hash of the exact script or model version executing. this creates a verifiable link between the audit record and the code that generated it.

§05ingesting events

every ai action, decision, or system event is recorded with a single ingest() call. the event_class determines the category. event_type is a free-form string scoped within the class.

basic event

receipt = requests.post(
    "https://api.syensystems.com/api/v1/events",
    headers=headers,
    json={
        "event_class": "EXECUTION",
        "event_type": "credit.decision.made",
        "stream_id": "your-tenant-id:prod-us-east-1:credit-decisions",
        "payload": {
            "applicant_id": "app-991",
            "decision": "APPROVED",
            "score": 740
        }
    }
).json()

print(receipt["event_id"])          # unique event identifier
print(receipt["sequence_counter"])  # position in the chain

event with human decision surface

when a human reviewed and approved a decision, include the decision_surface to record what was shown, when, and what they decided.

receipt = requests.post(
    "https://api.syensystems.com/api/v1/events",
    headers=headers,
    json={
        "event_class": "EXECUTION",
        "event_type": "credit.decision.made",
        "stream_id": "your-tenant-id:prod-us-east-1:credit-decisions",
        "payload": {"applicant_id": "app-991", "decision": "APPROVED"},
        "decision_surface": {
            "explainability_artifact_hash": "sha256-of-artifact-shown",
            "human_decision": "APPROVE",
            "presentation_timestamp": "2026-03-20T14:00:00Z",
            "signoff_timestamp": "2026-03-20T14:00:03Z",
            "decision_complexity_tier": 2
        }
    }
).json()

# True if signoff was under the threshold for the complexity tier
print(receipt["velocity_flag_triggered"])

event with extended context

pass optional context fields to capture ai model provenance, infrastructure details, and compliance gate results.

receipt = requests.post(
    "https://api.syensystems.com/api/v1/events",
    headers=headers,
    json={
        "event_class": "EXECUTION",
        "event_type": "model.inference",
        "stream_id": "your-tenant-id:prod-us-east-1:model-runs",
        "payload": {"output": "APPROVED"},
        "context": {
            "trace_id": "abc-123",
            "model_version": "risk-engine-v2.1.0",
            "compliance_gate_result": "APPROVED",
            "pii_detected": False,
            "cloud_provider": "aws",
            "cloud_region": "us-east-1"
        }
    }
).json()

event with full context objects

for governed ai decisions, pass the optional context objects to satisfy all 10 proof elements. each object is independently optional. pass only the objects relevant to your event type.

receipt = requests.post(
    "https://api.syensystems.com/api/v1/events",
    headers=headers,
    json={
        "event_class": "EXECUTION",
        "event_type": "credit.decision.made",
        "stream_id": "your-tenant-id:prod-us-east-1:credit-decisions",
        "payload": {"applicant_id": "app-991", "decision": "APPROVED"},
        "policy_context": {
            "policy_id": "policy-credit-v3",
            "policy_version": "3.1.0",
            "framework_name": "NIST_AI_RMF",
            "requirement_id": "GOVERN-1.2",
            "policy_effect": "ALLOW",
            "exception_approved": False
        },
        "data_lineage": {
            "data_asset_id": "dataset-credit-bureau-2026-q1",
            "data_source_system": "snowflake",
            "contains_pii": True,
            "contains_financial": True,
            "consent_basis": "contractual_necessity",
            "data_classification": "confidential"
        },
        "ai_execution_context": {
            "model_provider": "anthropic",
            "model_name": "claude-sonnet-4-6",
            "model_version": "20250514",
            "prompt_hash": "sha256-of-prompt",
            "response_hash": "sha256-of-response",
            "agent_runtime": "langchain",
            "agent_decision_type": "recommendation",
            "agent_reversibility_flag": False,
            "inference_latency_ms": 340
        },
        "guardrail_context": {
            "kill_switch_checked": True,
            "kill_switch_result": "PASS",
            "approval_gate_result": "APPROVED",
            "sandbox_executed": False,
            "risk_score": 0.12,
            "override_invoked": False
        },
        "human_review_context": {
            "human_review_required": True,
            "review_decision": "APPROVE",
            "final_approver_id": "user-analyst-007",
            "review_latency_ms": 4200,
            "reviewer_role": "credit_analyst"
        },
        "outcome_context": {
            "decision_result": "APPROVED",
            "actual_action_taken": "credit.line.issued",
            "downstream_system_notified": "oracle-ebs",
            "rollback_possible": False,
            "financial_impact_usd": 25000.00
        }
    }
).json()

§06event classes

syen comply supports eleven event classes covering the full lifecycle of an ai-assisted workflow. EXECUTION and OUTCOME are required for initial integration.

classuse forexample event_type
EXECUTIONai tool calls, model inference, human approvalscredit.decision.made
OUTCOMEfinal decisions: approved, blocked, escalatedloan.approved
ACCESSsession grants, privilege escalationsession.granted
DATAquery execution, dataset snapshotsdataset.queried
INTENTpolicy definitions, rule updatespolicy.updated
ANALYSISderived findings, drift detectionpolicy.drift.detected
DETECTIONsecurity incident detectionthreat.detected
RESPONSEactions taken during incidentsystem.isolated
CONTAINMENTcontainment actionsthreat.contained
ERADICATIONthreat removal confirmationmalware.removed
RECOVERYsystem recovery confirmationservice.restored

§07verifying the chain

the verify endpoint confirms the chain has not been tampered with. run this after any bulk operation or on a schedule to confirm ongoing integrity.

result = requests.get(
    "https://api.syensystems.com/api/v1/verify",
    headers=headers,
    params={"stream_id": "your-tenant-id:prod-us-east-1:credit-decisions"}
).json()

if result["verified"]:
    print(f"Chain verified: {result['checked_count']} events")
else:
    print("Integrity failure detected. Contact sales@syensystems.com.")

§08retrieving proof

for any event, retrieve the full non-repudiable proof package. this includes cryptographic signatures, chain linkage, and the human decision surface if present. payload data is never returned.

event_id = receipt["event_id"]

proof = requests.get(
    f"https://api.syensystems.com/api/v1/proof/{event_id}",
    headers=headers
).json()

# proof is available for independent verification
# contact sales@syensystems.com for auditor verification documentation
note: the complete proof verification procedure including independent openssl verification commands is provided to enterprise and federal customers under the technical onboarding package. contact sales@syensystems.com.

§09external timestamp anchoring

syen comply performs daily anchoring of the chain to an external fips-compliant trusted timestamp authority. the anchor record is retrievable via the api and independently verifiable by any authorized auditor.

anchor = requests.get(
    "https://api.syensystems.com/api/v1/anchor/2026-03-20",
    headers=headers
).json()

print(anchor["anchor_status"])      # complete
print(anchor["anchor_created_at"])

# independent verification documentation available to
# enterprise and federal customers on request

§10api reference

all endpoints require a bearer token from POST /api/v1/attest except GET /api/v1/health.

methodendpointdescription
POST/api/v1/attestestablish session, receive bearer token
POST/api/v1/eventsingest an audit event. accepts optional context objects: policy_context, data_lineage, ai_execution_context, guardrail_context, human_review_context, outcome_context. see §13.
GET/api/v1/proof/{event_id}retrieve cryptographic proof for an event
GET/api/v1/verifyverify chain integrity for a stream
GET/api/v1/healthsystem health and status
GET/api/v1/anchor/{date}external timestamp anchor record for a date

§11decision complexity tiers

when a human review is recorded, the velocity flag fires if the signoff was faster than the threshold for the tier. the event is always recorded regardless of the flag.

tiernameflag thresholduse for
1routine< 500mslow-stakes automated approvals
2standard< 2 secondsstandard business decisions (default)
3high-risk< 10 secondshigh-stakes or irreversible decisions

§12production deployment

syen comply deploys on kubernetes via helm chart. production deployment documentation including infrastructure requirements, kms configuration, and security hardening guidelines is provided to customers during technical onboarding.

contact sales@syensystems.com to begin the onboarding process. enterprise and federal customers receive dedicated deployment assistance.

§13context objects

the following six context objects may be passed as optional fields on any event POST. each object is independently optional. fields within each object are optional unless marked required.

policy_context

fieldtypedescription
policy_idstringidentifier of the policy that governed this event
policy_versionstringsemantic version of the policy at time of execution
framework_namestringcompliance framework — e.g. NIST_AI_RMF, SOC2, HIPAA
requirement_idstringspecific requirement within the framework — e.g. GOVERN-1.2
policy_effectstringdecision the policy produced — ALLOW, DENY, REQUIRE_REVIEW
exception_approvedbooleanwhether a policy exception was approved for this event
exception_approver_idstringidentity of the exception approver if exception_approved is true

data_lineage

fieldtypedescription
data_asset_idstringidentifier of the dataset or data asset used
data_source_systemstringsource system — e.g. snowflake, cloudera, oracle-ebs
contains_piibooleanwhether the data contains personally identifiable information
contains_phibooleanwhether the data contains protected health information
contains_financialbooleanwhether the data contains financial account data
consent_basisstringlegal basis for data use — e.g. contractual_necessity, consent
data_classificationstringclassification tier — e.g. public, internal, confidential, restricted
retention_policy_idstringidentifier of the retention policy governing this data
lineage_upstream_idsarray of stringsids of upstream datasets this asset was derived from

ai_execution_context

fieldtypedescription
model_providerstringmodel provider — e.g. anthropic, openai, google, aws
model_namestringmodel name — e.g. claude-sonnet-4-6, gpt-4o, gemini-1.5-pro
model_versionstringspecific model version string
prompt_hashstringsha-256 hash of the prompt sent to the model
response_hashstringsha-256 hash of the model response
agent_runtimestringagent framework — e.g. langchain, langgraph, custom
agent_decision_typestringtype of decision — recommendation, classification, generation
agent_reversibility_flagbooleanwhether the agent action can be reversed after execution
retrieval_sourcesarray of stringssource ids or uris used in rag retrieval
tool_calls_madearray of stringsnames of tools the agent invoked during this execution
inference_latency_msintegertime in milliseconds from prompt submission to response receipt

guardrail_context

fieldtypedescription
kill_switch_checkedbooleanwhether a kill switch was evaluated before execution
kill_switch_resultstringresult of kill switch check — PASS, BLOCK
approval_gate_resultstringresult of any approval gate — APPROVED, DENIED, BYPASSED
sandbox_executedbooleanwhether the action ran in a sandbox environment first
risk_scorefloatnumeric risk score assigned at time of execution — 0.0 to 1.0
override_invokedbooleanwhether a human override was used to bypass a control
override_approver_idstringidentity of the person who authorized the override

human_review_context

fieldtypedescription
human_review_requiredbooleanwhether human review was required for this event
review_decisionstringdecision made by the reviewer — APPROVE, REJECT, ESCALATE
final_approver_idstringidentity of the final human approver
review_latency_msintegertime in milliseconds from review request to final decision
review_interfacestringinterface used for review — e.g. servicenow, internal-portal
reviewer_rolestringrole of the reviewer — e.g. credit_analyst, compliance_officer

outcome_context

fieldtypedescription
decision_resultstringfinal decision — APPROVED, DENIED, ESCALATED, BLOCKED
actual_action_takenstringspecific action executed as a result — e.g. credit.line.issued
downstream_system_notifiedstringsystem that received the outcome — e.g. oracle-ebs, servicenow
rollback_possiblebooleanwhether this action can be reversed
financial_impact_usdfloatdollar value of the action if financially material

§14the 10 proof elements

syen comply is designed to satisfy 10 proof requirements that regulators, auditors, and courts apply to governed ai decisions. the table below maps each requirement to the api fields that must be present to satisfy it. an integration is considered complete when all 10 elements are populated for every governed event.

#proof requirementrequired fields
1who actedagent_id, tenant_id, agent_code_hash
2what actionevent_type, event_class
3what policy appliedpolicy_context.policy_id, policy_context.policy_version, policy_context.framework_name
4what data was involveddata_lineage.data_asset_id, data_lineage.contains_pii, data_lineage.consent_basis
5what model or agent ranai_execution_context.model_provider, ai_execution_context.model_name, ai_execution_context.prompt_hash
6what controls firedguardrail_context.kill_switch_checked, guardrail_context.approval_gate_result
7what outcome happenedoutcome_context.decision_result, outcome_context.actual_action_taken
8whether human reviewedhuman_review_context.human_review_required, human_review_context.review_decision
9compliance framework mappingpolicy_context.framework_name, policy_context.requirement_id
10record not alteredautomatic — cryptographic proof of integrity is applied to every event at time of ingestion and is independently verifiable. verification methodology and tooling are provided to enterprise and federal customers during technical onboarding.

§15source system mapping

syen comply accepts event data from any upstream system via the /api/v1/events endpoint. the mappings below show which syen comply fields to populate from each source system category and which event_class to use.

identity and access

source systems · okta, sailpoint, microsoft entra, cyberark, saviynt, prove

  • agent_idthe authenticated user or service account identifier
  • event_classACCESS for session grants, privilege escalations, access reviews
  • human_review_context.final_approver_idthe identity that approved the access decision
  • guardrail_context.approval_gate_resultthe access decision — APPROVED or DENIED
  • policy_context.policy_idthe access policy that governed the decision
  • data_lineage.data_source_systemset to the identity provider name

trigger · POST to /api/v1/events on every session grant, privilege escalation, mfa challenge result, or access review decision.

communications and archiving

source systems · global relay, smarsh, mimecast, proofpoint, arctera

  • event_classDATA for communication capture events
  • data_lineage.data_asset_idthe archived message or thread identifier
  • data_lineage.data_source_systemset to the archiving platform name
  • data_lineage.contains_piiset based on the communication content classification
  • payloadinclude communication type, channel, custodian identifiers
  • policy_context.policy_idthe supervision policy that flagged or cleared the communication

trigger · POST to /api/v1/events when a communication is flagged, escalated, placed on legal hold, or cleared by a supervision workflow.

fraud, aml, and investigations

source systems · nice actimize, feedzai, sardine, quantifind, featurespace, quantexa, fico falcon

  • event_classDETECTION for alerts fired, ANALYSIS for risk scores, OUTCOME for final case disposition
  • guardrail_context.risk_scorethe numeric risk score from the fraud or aml engine
  • guardrail_context.approval_gate_resultthe case decision — APPROVED, DENIED, ESCALATED
  • human_review_context.review_decisionanalyst disposition of the alert or case
  • human_review_context.final_approver_idthe investigator or analyst who closed the case
  • outcome_context.decision_resultfinal case outcome
  • outcome_context.financial_impact_usdtransaction value if financially material
  • ai_execution_context.model_providerthe fraud model provider
  • ai_execution_context.model_namethe specific detection model

trigger · POST on alert creation, case status change, analyst review, and final case disposition.

data and analytics

source systems · snowflake, cloudera, teradata

  • event_classDATA for query execution and dataset access
  • data_lineage.data_asset_idthe dataset, table, or view identifier
  • data_lineage.data_source_systemset to the platform name
  • data_lineage.contains_piiset based on dataset classification
  • data_lineage.contains_financialset based on dataset classification
  • data_lineage.lineage_upstream_idsupstream dataset identifiers if this dataset is derived
  • data_lineage.data_classificationthe data tier from your governance catalog
  • payloadinclude query hash, row count accessed, requesting service identity

trigger · POST on every governed dataset query, export, or transformation that feeds a downstream ai decision or compliance-relevant workflow.

ai execution

source systems · azure openai, aws bedrock, gemini api, langchain, langsmith

  • event_classEXECUTION for model inference events
  • ai_execution_context.model_providerthe model provider
  • ai_execution_context.model_namethe specific model
  • ai_execution_context.model_versionthe model version string
  • ai_execution_context.prompt_hashsha-256 hash of the prompt — do not send the prompt itself
  • ai_execution_context.response_hashsha-256 hash of the response — do not send the response itself
  • ai_execution_context.agent_runtimethe agent framework if applicable
  • ai_execution_context.tool_calls_madenames of any tools the agent invoked
  • ai_execution_context.retrieval_sourcessource ids used in rag retrieval
  • ai_execution_context.inference_latency_mslatency in milliseconds
  • policy_context.policy_idthe ai governance policy governing this inference

trigger · POST on every model inference that feeds a governed business decision. hash the prompt and response locally before sending. never send raw prompt or response content to the syen comply api.

appsec and code quality

source systems · veracode, sonarqube, checkmarx, mend, deepsource

  • event_classINTENT for policy and scan configuration changes, ANALYSIS for scan results
  • agent_code_hashsha-256 hash of the artifact that was scanned
  • policy_context.policy_idthe appsec policy that governs this artifact
  • guardrail_context.approval_gate_resultthe gate decision — APPROVED, DENIED, REQUIRES_REMEDIATION
  • payloadinclude scan tool name, finding count by severity, artifact identifier

trigger · POST on scan completion and on gate decision — approved to deploy or blocked pending remediation.

workflow and itsm

source systems · servicenow, pagerduty

  • event_classRESPONSE for actions taken during incidents, INTENT for change requests
  • payloadinclude ticket or incident identifier, assigned team, priority level
  • human_review_context.final_approver_idthe approver of the change or incident action
  • human_review_context.review_decisionAPPROVE or REJECT
  • guardrail_context.approval_gate_resultchange advisory board result if applicable
  • outcome_context.actual_action_takenthe specific configuration change or remediation applied
  • outcome_context.downstream_system_notifiedthe system that received the change

trigger · POST on change approval, incident escalation, production change execution, and incident closure.

endpoint and device

source systems · crowdstrike, jamf pro, microsoft intune

  • event_classDETECTION for endpoint threats, ACCESS for device compliance checks
  • data_lineage.data_source_systemset to the endpoint platform name
  • guardrail_context.risk_scoredevice risk score from the endpoint platform
  • guardrail_context.approval_gate_resultPASS or BLOCK based on device compliance state
  • payloadinclude device identifier, os version, compliance policy result, detection type if applicable

trigger · POST on device compliance check failures, threat detections, and policy enforcement actions that gate application or data access.

finance and ap/ar

source systems · blackline, sap ariba, coupa, oracle ebs, tipalti, highradius

  • event_classEXECUTION for payment and approval actions, OUTCOME for final financial decisions
  • outcome_context.financial_impact_usddollar value of the transaction
  • outcome_context.actual_action_takenthe specific financial action — e.g. payment.issued, credit.line.approved, invoice.written.off
  • outcome_context.downstream_system_notifiedreceiving system — e.g. oracle-ebs, bank-api
  • human_review_context.final_approver_idthe finance approver identity
  • human_review_context.review_decisionAPPROVE or REJECT
  • policy_context.policy_idthe financial controls policy governing this transaction
  • data_lineage.data_source_systemset to the finance platform name

trigger · POST on payment approval, write-off approval, credit decision, vendor onboarding approval, and any transaction that requires an audit trail for sox, gaap, or regulatory examination.

§16support

syen systems llc · sales@syensystems.com
integration guide · v1.2 · april 2026
integrations → support →