Every action arrives with its evidence, a receipt an outsider verifies without your logs, under the policy version that was in force.
For Heads of compliance and internal audit, DPOs, external auditors and advisers, and the supervisors who read the evidence.
Internal audit tests a control by asking for evidence, and for an AI agent the evidence today is a log written by the system that acted. An auditor can read it. An auditor cannot rely on it, because the team that runs the automation also owns the log, the limits and the ability to change both.
That gap is about to cost money. The AI Act asks deployers for records and human oversight from 2 December 2027. DORA already holds a financial firm responsible for every AI vendor it uses, and CCD2 gives consumers a person's review of automated credit decisions from 20 November 2026. None of them names a tool, and all of them ask for proof.
Stategram makes the proof a by-product. Every permit and every referral carries a receipt signed outside the team and checked offline against the policy version in force. The referral above the line is the human confirmation, with a name on it. The control test becomes a receipt check.
What was asked, which rule answered, under which version and signer. A refusal comes back with the rule that fired.
You check a permit offline in about 10 ms, with nothing from us or from the firm.
Above the line, the named approver's decision is part of the record.
Every change to the numbers is a signed edition, so the rule on any date can be shown.
An example receipt, written for this page. Permits and referrals are signed before the answer goes out. A refusal comes back with the rule that fired.
Two weeks, a fixed fee, your limits and a named approver, and the method to do the next workflow yourself.
We will email you to find a time for a 25-minute walkthrough with the founder. No slides, no sales script.
Pick a time in the founder's calendar, or tell us about your agent first.