Replay

AI systems rarely fail the same way twice. When one does fail — an approval that should have been blocked, a refund that got through, a tool call that leaked data — reconstructing what happened is harder than fixing the bug.

The logs show fragments. The prompt has drifted. The model weights moved. The person who wrote the policy left. By the time anyone asks "why did it do that?", the answer is already gone.

Logs are optimised for debugging engineers who were there yesterday, not auditors who arrive next quarter. They capture output, not reasoning. They record the request, not the rules that let it through.

Traces show the call graph but not the counterfactual — what would have happened under a stricter policy, or a different approver, or last week's version of the same agent.

A replay is a re-execution of a past decision against a preserved record of its inputs, the rules in force at the time, and the verdicts each rule produced. If the inputs and rules are captured faithfully, the replay reaches the same verdict — deterministically — no matter who runs it or when.

Every allow, ask, or deny at the run-time gate is captured in a portable record — inputs, policy fingerprint, verdict, signature — sealed at the boundary of the governed unit it belongs to. That record is what Prove replays.

• Govern. Policies compile to a versioned bundle with a stable fingerprint.
• Run. Every decision stamps its bundle fingerprint and inputs.
• Prove. The same bundle + inputs → the same verdict, on any machine, forever.

A support agent auto-approved a $9,400 refund at 03:12 UTC. Two weeks later a customer flags it. You open the decision by its ID and hit Replay.

The record shows the exact tool call, the refund policy fingerprint at that moment, and the four rules that fired. Rule refund.threshold.usd matched at 10,000; the request came in at 9,400. The verdict was correct under the rules in force that night.

You raise the threshold, ship a new bundle, and the next replay against today's rules returns deny. The historical decision remains valid; the policy just changed.

Isn't this just a detailed log?

A log tells you what output happened. A replay lets you re-derive it. If the replay disagrees with the log, one of them is wrong — and you can tell which.

What if the model is non-deterministic?

Replay covers the governance decision, not the model's next token. The verdict on any given tool call is deterministic in the inputs and the policy bundle, even when the model that produced the request is not.

Do I need Aarmos running to replay?

No. The record verifies with a standalone binary; see the verifier.

• Receipts
• Evidence
• Authorities
• Why governance?