​

AI Turn Audit: Verbatim AI Decision Records

​

What this control does — and why it is fail-closed

• the full system prompt and user prompt as sent to the model (verbatim, unredacted — a regulator must be able to reproduce the decision context),
• the final assistant response,
• model and version, token counts, latency, confidence, and the outcome (ok, escalated, refused, error, cost_capped),
• retrieval references (document name, score) and tool-call references (name, status, duration).

​

Enable and disable (the Settings toggle)

curl -X GET "https://api.orbit.devotel.io/api/v1/settings/compliance/ai-turn-audit" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

{
  "data": { "enabled": true }
}

curl -X PUT "https://api.orbit.devotel.io/api/v1/settings/compliance/ai-turn-audit" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "enabled": true }'

​

Filter and paginate the recorded turns

curl -X GET "https://api.orbit.devotel.io/api/v1/agents/ai-turn-audit?from=2026-08-01T00:00:00Z&to=2026-09-01T00:00:00Z&limit=200" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

{
  "data": {
    "rows": [
      {
        "id": "a9e7f47c-…",
        "conversation_id": "conv_9m2hj",
        "agent_id": "agt_support1",
        "model": "claude-sonnet-4-6",
        "model_version": null,
        "system_prompt": "You are a support agent for …",
        "user_prompt": "My invoice shows the wrong VAT.",
        "assistant_response": "Let me pull up the invoice …",
        "retrieval_refs": [],
        "tool_call_refs": [
          { "toolName": "get_invoice", "status": "ok", "durationMs": 412 }
        ],
        "confidence": 0.93,
        "outcome": "ok",
        "prompt_tokens": 1820,
        "completion_tokens": 214,
        "latency_ms": 1340,
        "request_id": "req_…",
        "human_override_user_id": null,
        "human_override_reason": null,
        "human_override_at": null,
        "created_at": "2026-08-29T11:22:41.319Z"
      }
    ],
    "next_cursor": "2026-08-29T11:22:41.319Z|a9e7f47c-…",
    "count": 200
  }
}

• One conversation: GET /api/v1/agents/conversations/{conversationId}/ai-turn-audit — the per-conversation evidence chain behind the dashboard’s chain-of-decisions panel.
• DSAR (Art. 15): enumerate the subject’s conversations and pull each through the per-conversation route; see DSAR.

​

Record a GDPR Art-22 § 3 human override

curl -X POST "https://api.orbit.devotel.io/api/v1/agents/ai-turn-audit/a9e7f47c-…/override" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Customer disputes the automated refund refusal — reviewed by operator sara.k, ticket T-11452, Art-22 § 3 contest upheld"
  }'

• The auditId path segment is the row’s UUID.
• reason is free text, 1–2000 characters, trimmed server-side.
• Append-once: a second override on the same row returns 409 OVERRIDE_ALREADY_APPLIED; an unknown id returns 404 AUDIT_ROW_NOT_FOUND.
• Access is owner/admin — the same gate as the tenant export.

​

Periodic export — JSONL with a 5000-row soft cap

​

When to leave it off vs on

• HIPAA — healthcare tenants under an executed BAA whose data-handling rules mandate verbatim decision records. Pair with closing the inbox AI privacy gates and a retention window; see Posture D in the posture map.
• SOC2 — control-evidence for CC-series change-management and incident-review controls; pair with the archival export binder and the SOC2 controls page.
• FINRA — broker-dealer review of automated decisioning; the periodic JSONL export is the artifact reviewers expect.

​

Related references

• Posture overview — the toggle map: where AI-turn audit sits in the whole control surface.
• HIPAA — BAA, HIPAA mode, the inbox AI gates.
• SOC2 controls — control-evidence export.
• Data retention policy — the retention window for verbatim prompt rows.
• DSAR — Art. 15 export per data subject.
• Evidence binder — hands the whole posture to a buyer or authority.
• Compliance health — the read-only safety layer.