> ## Documentation Index
> Fetch the complete documentation index at: https://attesta.kyberon.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# attesta audit
> Verify audit log integrity, view approval statistics, and detect rubber-stamp approvals
The `attesta audit` subcommands let you inspect and verify the SHA-256 hash-chained audit trail that Attesta produces. Every gated action -- approved, denied, timed out, or escalated -- is recorded in a JSONL file with cryptographic integrity guarantees.
## Shared Options
All `attesta audit` subcommands accept:
| Flag | Default | Description |
| ------------ | ---------------------- | -------------------------- |
| `--log PATH` | `.attesta/audit.jsonl` | Path to the audit log file |
***
## attesta audit verify
Verify the hash-chain integrity of the audit log. Each entry contains a SHA-256 hash of the previous entry, forming a tamper-evident chain. If any entry has been modified, inserted, or deleted, the chain breaks.
### Usage
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit verify [--log PATH]
```
### Example Output (Intact)
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
$ attesta audit verify
Audit log : .attesta/audit.jsonl
Entries : 247
Status : INTACT -- all hashes verified
```
### Example Output (Broken)
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
$ attesta audit verify
Audit log : .attesta/audit.jsonl
Entries : 247
Status : BROKEN -- 2 invalid link(s)
Broken at : 42, 43
```
A broken audit chain indicates that one or more entries have been tampered with, manually edited, or that the log file was corrupted. Investigate immediately -- the broken link indices tell you exactly which entries to examine.
The command exits with code `0` on success and code `1` if the chain is broken, making it suitable for CI pipelines:
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit verify || echo "Audit chain compromised!"
```
***
## attesta audit stats
Print comprehensive approval statistics from the audit log, including totals by verdict, average review time, rubber-stamp rate, and risk level distribution.
### Usage
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit stats [--log PATH]
```
### Example Output
```
Audit Statistics
Log file : .attesta/audit.jsonl
Totals
Total entries : 247
Approved : 198
Denied : 31
Modified : 5
Escalated : 8
Timed out : 5
Review Quality
Avg review time : 12.4s
Rubber stamp rate : 3.2%
Rubber stamps : 6
Risk Distribution
Low : 89
Medium : 94
High : 47
Critical : 17
```
### Understanding the Output
| Metric | Description |
| --------------------- | -------------------------------------------------------------------------------- |
| **Approved** | Actions that passed their challenge and were executed |
| **Denied** | Actions explicitly rejected by the operator |
| **Modified** | Actions approved with modifications to the original parameters |
| **Escalated** | Actions forwarded to a secondary approver or webhook |
| **Timed out** | Actions where the review period expired without a response |
| **Avg review time** | Mean time operators spent reviewing before making a decision |
| **Rubber stamp rate** | Percentage of approved high/critical actions with suspiciously fast review times |
A rubber-stamp rate above 10% (shown in yellow) or 20% (shown in red) suggests operators may be approving high-risk actions without adequate review. Consider increasing `minimum_review_seconds` in your `attesta.yaml`.
***
## attesta audit rubber-stamps
List individual audit entries that were approved suspiciously fast relative to their risk level. These are potential rubber stamps -- approvals where the operator likely did not read or understand the action.
### Usage
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit rubber-stamps [--log PATH] [--max-seconds 5.0] [--min-risk high]
```
| Flag | Default | Description |
| --------------- | ------- | -------------------------------------------------------------------- |
| `--max-seconds` | `5.0` | Maximum review time (in seconds) to flag as a rubber stamp |
| `--min-risk` | `high` | Minimum risk level to consider (`low`, `medium`, `high`, `critical`) |
### Example Output
```
Found 3 rubber stamp(s):
1. deploy_to_production [High] 2.1s review a4f8b2c1e3d5...
Agent: gpt-4-agent
Time: 2025-01-15T14:32:18
2. execute_migration [Critical] 1.8s review b7e2a9f4c6d8...
Agent: claude-agent
Time: 2025-01-15T15:01:42
3. modify_firewall [High] 3.4s review c1d5e8f2a9b7...
Agent: ops-bot
Time: 2025-01-16T09:15:33
```
### Narrowing the Search
Find only critical-risk rubber stamps approved in under 3 seconds:
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit rubber-stamps --min-risk critical --max-seconds 3.0
```
Find all rubber stamps including medium-risk actions:
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
attesta audit rubber-stamps --min-risk medium --max-seconds 5.0
```
When no rubber stamps are found:
```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
$ attesta audit rubber-stamps
No rubber stamps found.
```
***
## CI/CD Integration
You can use audit commands in CI/CD pipelines to enforce audit hygiene:
```yaml github-actions.yml theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
- name: Verify audit integrity
run: attesta audit verify
- name: Check rubber stamp rate
run: |
attesta audit stats
# Fail if rubber stamp rate is concerning
attesta audit rubber-stamps --min-risk high --max-seconds 3.0
```
The audit log is append-only by design. Attesta never modifies or deletes existing entries. The hash chain makes any external tampering detectable via `attesta audit verify`.
## Next Steps
Manage agent trust profiles
Learn how the hash-chained audit log works