EU AI ACT · SR 11-7 · SEC AI BULLETIN · NIST AI RMF

When your AI agent causes harm,
can you prove what it did?

BLACKBOX seals every reasoning step, tool call, and output into a cryptographic hash chain. Any post-hoc alteration breaks. Detectably, permanently, without trusting us. One command from an auditor's laptop verifies everything.

TRIBUNAL — Live Adversarial Examination Demo →
47runs recorded
335events sealed
5Merkle anchors
100%chain integrity
promptblackbox.com/dashboard
RUNS
STREAM
HEALTH
COST
LATENCY
INTEGRITY
SOC 2
REPORT
RECORDED RUNSAPPEND-ONLY · CHAIN-SEALED
47
total runs
335
events sealed
100%
chain integrity
2
models
run_meridian_003claude-sonnet-4-620 events⚠ 3 faults
code_review_91b62f70claude-sonnet-4-626 events✓ verified
h_cost_da287bf1claude-haiku-4-59 events✓ verified
compliance_gdpr_57b37024claude-sonnet-4-610 events✓ verified
fraud_monitor_e94580c4claude-sonnet-4-610 events✓ verified
GENESIS
00·sha256·07e5c3a1
REASONING
01·sha256·d4b2907e
TOOL_CALL
02·sha256·a18f6d4b
OUTPUT
03·sha256·7e5c3a18
SEAL
04·sha256·4b2907e5

Three calls you don't want to get.

These incidents already happened at companies that had application logs, not audit chains.

FINANCIAL SERVICES
“The algorithm executed a series of orders that cost us $4.2M. The regulator wants the exact decision chain at 14:07:33 UTC. Our inference logs don't match the trade records.”
→ No audit trail. $47M fine. 3-year consent order.
HEALTHCARE AI
“The triage AI deprioritized a patient who later died. The investigation needs verbatim model I/O at 03:14 AM. The logs rotated out six days ago.”
→ Cannot reconstruct. Litigation ongoing. System pulled from production.
ENTERPRISE AI GOVERNANCE
“The board audit committee is asking what our AI agents actually did last quarter. We have model names and token counts. We don't have what they're asking for.”
→ No cryptographic proof. AI deployment paused indefinitely.
These are not hypotheticals. AI incidents are accelerating. Regulators are asking for cryptographic evidence, not application logs.
Start recording before it happens →
hash = sha256(prev_hash + canonical_json(event))

Every event commits to all prior events. Alter a single byte of a system prompt, a reasoning step, a token count. Every downstream hash changes. The chain breaks at that point. Verifiable in O(n) with stdlib sha256 only. No BLACKBOX infrastructure required.

01
Ingest
Your agent calls POST /v1/events or uses the SDK. The server assigns sequence, computes prev_hash, and seals the event. Append-only: there is no UPDATE or DELETE path for events. Ever.
02
Chain
hash = sha256(prev_hash + canonical_json(event_without_hash)). Genesis uses prev_hash = "GENESIS". Each event's hash is a commitment to every event that came before it. One tampered byte breaks the chain from that point forward.
03
Anchor
Every day, all sealed runs are committed into a Merkle tree. The root is published. Any run can be proven to have existed before the root with a log(n) inclusion proof. Independently verifiable from first principles.
04
Verify
GET /v1/audit/{run_id} returns a public certificate. No auth, share with any auditor or regulator. Chain validity is recomputed on read. No stored result to falsify. The math is the guarantee.

Built for the people accountable for AI risk.

CISO
“Prove to me the AI decision log wasn't altered after the incident.”
Chain integrity is mathematically enforced, not policy-enforced. A tampered event breaks every hash downstream from that point. Verifiable in O(n) with stdlib sha256. No BLACKBOX infrastructure required. Give the raw events to any auditor and they can verify it themselves.
HEAD OF MODEL RISK
“How do I know the fault rate numbers my team reports are real?”
Every metric (fault rate, cost per verified output, p99 latency, model drift) is derived from the sealed, append-only event store. Not self-reported. Not from a dashboard someone controls. From the immutable record. SR 11-7 compliance evidence, ready to export.
PE OPERATING PARTNER
“Six portfolio companies are deploying AI. What's my liability surface?”
One recorder across every agent in every portfolio company. Compliance PDFs dated and signed. Legal hold that cannot be bypassed. GDPR crypto-shred without breaking the chain. A risk committee presentation that starts with: “Here is the cryptographic proof.”

Ten lines. Any agent. Any framework.

PythonTypeScriptHTTP (cURL)
pip install blackbox-sdk
import blackbox_sdk as bb

bb.configure(api_url="https://blackbox-gold.vercel.app")

with bb.run(
    "agent_001",
    model="claude-sonnet-4-6",
    system_prompt=SYSTEM_PROMPT,
    tools=["web_search", "calculator"],
    sampling={"temperature": 0.3},
) as run:
    run.reasoning("Planning next step")
    run.tool_call("web_search",
        inputs={"query": "Q3 revenue"}, result=hits)
    run.output(
        "The Q3 revenue was $4.2M",
        tokens_in=520, tokens_out=180,
        cost_usd=0.0042, latency_ms=1340,
    )
# ↑ Sealed automatically. Chain is provable.
Context manager pattern
Automatic seal on exit. Fault event recorded on unhandled exception.
Single dependency
Zero external dependencies. Stdlib urllib only. Works in any Python 3.11+ environment.
Typed & explicit
Full type hints throughout. Every method is annotated: run.reasoning(), run.tool_call(), run.output().
Auto-instrumentation
bb.instrument() patches openai + anthropic at startup. Zero agent code changes. Every LLM call is auto-recorded.
Retry & fail-open
3-attempt retry on transient errors. Never blocks your agent on recorder failure.
OTel compatible
Point your OTEL_EXPORTER_OTLP_ENDPOINT here. GenAI spans auto-convert.

From zero to a verified, tamper-evident AI run.

Install the SDK, record your first run, and produce a cryptographic audit certificate. in the time it takes to read this page.

01
Install
pip install blackbox-sdk. Zero external dependencies, stdlib urllib only.
02
Configure
One line: bb.configure(api_url="..."). No API key needed to start.
03
Record a run
Wrap your agent in a context manager. Every step is sealed into the chain automatically.
04
Verify the chain
GET /v1/audit/{run_id} returns a public certificate. Recompute with stdlib sha256 to prove it.
Start the tutorial →10 steps · working code · copy-paste ready

Don't trust us. Verify yourself.

01
Independent chain verification
Replay any run from the raw events using sha256 and canonical JSON. Zero BLACKBOX infrastructure. One Python function, 12 lines, stdlib only.
02
Merkle inclusion proof
Every run gets a sibling-path proof against the daily Merkle root. Prove a run existed before a given timestamp. Verify with log(n) hashes.
03
Public audit certificates
/v1/audit/{run_id}. No auth, share with any auditor. Chain validity computed fresh on every request. No cached result to falsify.
04
Tamper test in the repo
There is a pytest that alters a stored event and asserts the chain breaks. That test is run in CI and must always pass. It is the definition of done for anything touching the event store.

Your AI agent just failed its bank exam.

TRIBUNAL is an adversarial examiner trained on Federal Reserve SR 11-7 — the model risk management guidance Tier-1 banks operate under. It cross-examines a recorded agent run the way a hostile bank examiner would. No charity. No benefit of the doubt.

⛔ ADVERSE
The record does not demonstrate adequate control. The agent cannot be validated as model-risk compliant. A re-examination path is specified.
⚠ QUALIFIED
Gaps identified but remediable. Apply the stated controls, submit the same trace for re-examination. TRIBUNAL rules strictly — it credits genuine fixes only.
✓ CLEAN
The record is complete and the controls hold. The examination evidence is ready for delivery to a regulator or audit committee.
FINANCIAL ANALYSIS · MEDICAL TRIAGE · CONTRACT REVIEW · NO LOGIN REQUIRED
Run the adversarial examination →

Start free. Scale when you need to.

STARTER
Free
For developers and teams evaluating AI governance.
  • Up to 1,000 runs / month
  • Full hash chain & Merkle anchoring
  • Python + TypeScript SDK
  • OTel compatible
  • Public audit certificates
  • 90-day retention
Start free →
ENTERPRISE
Custom
For regulated industries, PE portfolios, and large deployments.
  • Everything in Pro
  • Dedicated infrastructure
  • Custom retention policies
  • Multi-tenant isolation
  • SLA + audit support
  • Procurement & MSA
Book a demo →
“The aviation black box doesn't make planes safer by itself. It makes crashes survivable as information.BLACKBOX does the same for AI agents. Every fault, every decision, sealed into a chain that cannot be altered after the fact.”
BLACKBOX product thesis
TWO LINES OF CODE · FIRST RUN FREE

The incident hasn't happened yet.
Start recording before it does.

Every day your agents run without a tamper-evident record is a day you can't prove what happened. The regulator doesn't accept “we had logs.”

sha256 · append-only · Merkle-anchored · regulator-ready