Your agent's audit log is a story, not evidence

Almost every tool-governance layer I have looked at writes its log after the call returns. Some write it in a finally . Some batch it. Some hand it to a logging framework that flushes on its own schedule. That ordering quietly decides what your log can be used for. If the record is written after the body runs, then a record that is missing has two possible explanations, and nothing in the file distinguishes them: The call was never authorised, so it never ran. The call was authorised, ran, did its work, and the process died before the log line reached disk. Those are not close together. One is the control working. The other is an unlogged deletion. When someone asks you six weeks later what your agent was permitted to do at 03:14, "there is no line for it" answers nothing. So I wrote a small library that inverts the order. obstat obstat is an auditable decision record for agent tool calls. Nihil obstat — nothing stands in the way — was the formal clearance a censor granted in writing, before publication . That is the whole idea. from obstat import guard @guard ( resource = " doc:{doc_id} " ) def delete_document ( doc_id : str ) -> str : ... An agent asks to do something, a rule decides, and the decision goes to disk — written and fsync ed — before the tool body executes. If the process dies mid-call, the record still says what was authorised, for whom, against which resource, and why. record.decision() returns only after the fsync returns. Not flushed after, not deferred, not batched. Everything else in the library is convenience; this is the part an examiner relies on. The claim has a test, not a paragraph An architectural promise nobody can falsify is marketing. This one is checked by reading the log from inside the tool body — the one place where anything buffered, deferred, or written afterwards is invisible: def test_record_is_durable_before_the_body_runs ( workspace ): workspace ( ALLOW_ALL ) seen : dict [ str , list ] = {} @guard () def read_thing ( what : st