Hiveram
The system of record for AI work.
Hiveram connects recorded intent, execution evidence and review history so that someone who did not perform the work can examine it.
We name the frameworks your auditors use so you can see where the evidence sits. Naming a standard is not a claim of conformance, and Obsta Labs holds no certification against any of them.
Answers 1–6
Most teams can now make AI do work. Far fewer can independently demonstrate what happened. When the only history lives inside the tool that performed the action, your evidence depends on the system you are trying to govern.
When an AI system sends a message, changes a record, approves a request or triggers another system, ordinary logs tell you about execution. Governance requires more: who authorised the work, what the AI was trying to do, what data it touched, who could intervene, what evidence it produced, and how the work was closed.
Hiveram keeps that record outside the AI actor. Every piece of work begins with an authorised intent, is claimed by an identified actor, accumulates runs and evidence, records failures and interventions, and is closed independently of the agent that performed it. That gives governance, compliance and quality teams answers to six questions.
Answers — this is the list
Different frameworks use different words. The operational questions converge on these six, and every other answer on this page points back to them by number.
Answers 1, 3, 4, 6
Logs record events. Hiveram records accountable work: the intent, the authority, the actor, the execution, the evidence, the revisions and an independent closure stay connected as one record. Four things ordinary AI logs do not give you:
Two kinds of entry sit in that record, and the difference matters to a reviewer. Hiveram checks some entries against another source: that a linked commit is reachable on the declared repository, what the repository’s own check-runs concluded where you have authorised that read, and that the identity closing the work is not the identity that executed it. Other entries are submitted: notes, evidence references and artifact hashes are recorded as given, with who gave them and when. For work recorded through Hiveram, the record connects the stated intent, the actor, the submitted evidence and the closure history. It supports review; it does not by itself establish that every reported action occurred as described.
A real record from our own ledger, workledger/WO-2274. Redacted where marked; nothing added. Numbers on the right are the six questions above. What it shows is a work history, a commit bound to the work order and a closure by a different identity. It does not show a named person approving a specific action before that action, corroborated by a second record; the claimant was not retained in this record and the closing identity is a role, not a person.
We do not claim that nobody with access to your own infrastructure could alter it. We claim the governance record exists outside the actor from the start of the work.
Answers 1, 4
A log inside the vendor’s product is the system grading its own homework. The vendor controls it, you may lose it when you change vendors, and it rarely records who authorised an action or what the person approving it saw. Ask any vendor one question: can I show my auditor the full record of what your system did, without you in the room? You need durable access to, and control of, the record that does not depend on continued access to the vendor.
Answers 1, 3, 4
ISO/IEC 42001:2023 is a management-system standard. It asks your organisation to set AI policy, assess impact, assign roles, monitor AI systems through their lifecycle, and keep documented information showing all of that happened. It does not produce that information.
A record of AI activity — who authorised it, its purpose, its execution history and the supporting evidence — can provide the documented information your management system needs. Hiveram keeps that record outside the AI actor. Naming the standard is not a conformance claim; it is a description of where the evidence sits. Source
Answers 2, 4, 5
NIST’s AI Risk Management Framework 1.0 (an update is in progress) has four functions, Govern, Map, Measure and Manage, and calls for documentation, measurement and monitoring across the AI lifecycle. Our design response is to keep that record outside the agent being governed, so Measure and Manage rest on an account that does not depend on the system under measurement. Source
ISO/IEC 23894:2023 gives guidance on managing AI risk inside your existing processes, and like the risk-management practice it builds on, it asks you to record and report what happened. The record is where that lives. Source
Answers 1–6 · Last regulatory review: 2026-10-12
Practice guidance. In Singapore, the Accounting and Corporate Regulatory Authority issued Audit Practice Guidance No. 1 of 2026, Using Artificial Intelligence Responsibly, on 2 October 2026. It describes audit documentation of AI-assisted work that may include the prompts used, the key assumptions, significant revisions made after human review and the rationale for accepting or rejecting an AI recommendation, so that a reviewer can follow what was done; the auditor remains accountable for the work. Source
Supervisory expectations. On 7 October 2026 the Monetary Authority of Singapore finalised its guidelines on artificial intelligence risk management for financial institutions, including inventories of AI use and accountability for third-party AI, with the first obligations taking effect from 7 October 2027 and the remainder a year later. Source
Consultation draft. In Malaysia, the Personal Data Protection Department opened a public consultation on 5 October 2026, closing on 23 October 2026, on a draft Artificial Intelligence and Personal Data Protection Framework under the Personal Data Protection Act 2010. The draft’s Part J lists, among the records a data controller keeps and makes available to the Commissioner on request, “relevant assessments, approvals and material decisions” and “governance decisions and approvals” (clauses 40.4(d), 40.5 and 42.3(e)). It is a draft under consultation; what the final text will require is not yet known. Source
Law in force. South Korea’s AI Basic Act and its Enforcement Decree took effect on 22 January 2026. The Ministry of Science and ICT has announced a grace period of at least one year during which penalties will generally be deferred while organisations prepare. Under Article 34, a business providing high-impact AI must operate risk management measures, ensure human oversight, and prepare and retain documents that verify those measures; Article 35 asks it to endeavour to assess the impact on fundamental rights in advance. Source
Law in force. In the European Union the AI Act already applies in stages: most provisions since 2 August 2026, obligations for high-risk systems from 2 December 2027 and, for AI embedded in regulated products, from 2 August 2028. The evidence you need depends on the system and on your role under the Act (European Commission timeline). These laws can also reach suppliers outside their home jurisdictions, depending on where a system is placed on the market, deployed, supplied or used, and on the supplier’s contractual role. We describe these texts as published, and we label each by what it is. None of them, alone, requires anyone to adopt an independent ledger; each asks for documentation that a reviewer can follow, and that is where the record sits. We are not your counsel, and this page will change when the dates do.
Answers 1, 4, 5
Your team works through its existing tools, licences and access, and writes the record through the Hiveram CLI, API or MCP server as the work happens. Hiveram receives the records submitted to it; it holds no credentials to your other services and does not perform the work itself. Where you authorise it, GitHub verification also reads check results from your own repositories. When what an agent did cannot be recorded in the form the record requires, the record refuses to close the work and says why.
If your existing tickets and logs already let an independent reviewer reconstruct who authorised a piece of AI-assisted work, what was done and who reviewed it, assess whether another system adds anything before adopting one.
Answers 1–6
No to both. Obsta Labs holds no certification against ISO/IEC 42001, ISO/IEC 23894, the NIST AI RMF or any other standard named here, and using our products does not by itself make you conformant to any of them. Certification is your organisation’s achievement, against your management system. Our part is making sure the evidence exists when the auditor asks.
Answers 1, 5, 6
In Hiveram, closing work requires an identity that is not the agent, so an agent cannot mark its own work done. Which actions need a human signature is your policy; the record shows who signed and when. Hiveram applies the same separation-of-duties principle: execution and closure are different identities.
An agent works under a claim the ledger grants. A person can see every active claim and release it, and the release is on the record. Hiveram records interventions and claim releases; whether an agent stops acting depends on the controls in its execution environment. What the record withholds is closure: work is not marked done until a different identity closes it. When a run fails, it is recorded against the work it addressed, so a failure is an entry in the record rather than a gap in it.
Answers 1, 4
Policy checks happen inline with the work they govern; the alternative is reconstructing evidence after an incident. The record is written as the work happens, through the same steps the agent already takes — claim, work, close — not reconstructed afterwards.
We run our own company on our own products: a fleet of AI agents builds the software, and every piece of work carries a contract, a verification step and a closer who is not the author.
Answers 2, 3, 5
Hiveram is the record. Two companion products cover the edges around it, and neither is required to use it.
What leaves your network. With NeuroRouter in front of your model providers, detected credentials, tokens and connection strings are redacted or blocked before a request is forwarded, according to your policy. It runs locally, forwards only to the upstream provider you configure, and does not phone home. It is not a promise to catch every encoded or transformed secret — it removes a hosted credential store from the path.
High-stakes verdicts. For a high-stakes decision, VectorCourt checks before anyone acts whether the question can support the verdict asked of it, and signs what it produces.
Answers 4
With you. Hiveram runs locally, on infrastructure you control against your own PostgreSQL, or managed by us if you prefer. Nothing leaves your environment unless you decide it does. It installs with one command; see the install guide, and pricing for plans and the 14-day trial.
These questions come from real cases: see public cases, each with its primary source.
For security-gate teams: where your check results, waivers and closures sit.