At its core is the audit pack: a ZIP archive that captures exactly one scan snapshot. Alongside it come audit reports for individual agent answers and the event log of the engagement.
Executive report as PDF; findings, their activity history and control owners as CSV; scan metadata as JSON; plus a README. Tenant-wide registers – data-subject requests, incidents, risk assessments – are included only when the export is created with administrator rights.
Lists the scan, UTC timestamps, the contents, the SHA-256 value and size of every file, the method version of the assessment and the statement limits of the pack.
Per finding: framework, control ID, severity, status, recommendation and owner. Plus review status, the four-eyes marker (independently reviewed, self-review or undetermined), risk acceptances with expiry and reason, and the closure reason.
Every entry on a finding with its type, author and UTC timestamp.
For a single chat answer: question, answer, linked sources, the answering agent, the model used, the guardrail status and the timestamps.
The explanation view lists, for every linked source, the document and, where available, the section or page, the quoted excerpt, the document version and the retrieval time – so you can open the passage in the original.
Per engagement, creation, scan start and end, attestation, delivery and report generation are logged as a SHA-256 chain. The database permits neither changing nor deleting entries.
On every scan the platform collects the evidence afresh from the connected systems. Scans can be scheduled to repeat, so snapshots do not only appear on the due date.
Formats: ZIP with PDF, CSV and JSON · engagement report as PDF or DOCX · audit report for single answers as PDF
Five steps for a sample. You can do the first two with your own tools, without access to the platform.
Compute the SHA-256 value of every file with a tool of your choice, such as sha256sum or Get-FileHash, and compare it with the entry in 00_manifest.json.
Pick findings from 02_findings.csv and trace in 03_audit_trail.csv who worked on them and when. Score and counts come from the same calculation as the dashboard and reports for the same scan.
Ask for the audit report of an agent answer. Open the cited source – document, section or page, version – in the original and compare the excerpt.
For each reviewed finding the four-eyes marker shows whether it was confirmed independently or by self-review. The attestation of an engagement is in the event log with the acting person and time.
The chain check recomputes every hash of the event log. It runs in the platform and requires administrator rights – ask to see it run. Result: chain intact with the last hash value, or the number of the first entry that does not match.
The same limits are stated in the manifest of every audit pack.
We agree read access for your audit with your client. It is set up through the client’s own user management:
Are you preparing an audit at a client that uses Agentic360, or would you like to walk through the audit pack on an example? We will show you its structure and the verification steps in a demo.
Discuss audit support