When a person changes a firewall, you can ask them why. When software does it at 03:00, you need a record that answers the same questions: what changed, why, who allowed it, and did it work? And it has to be a record nobody, including the software, can quietly edit.
Hash-chained, append-only logging
In Vantage Guardian, every decision, command, approval, refusal and result is written to an append-only activity log. Each entry includes a cryptographic hash of the entry before it. Change, delete or reorder anything and the chain breaks visibly when verified.
A chain alone can’t prove nothing was cut off the end, so periodic checkpoint copies of the chain head are sent off the box, for example to the client’s own log server. Truncation then becomes detectable too. Guardian can’t edit its own trail. That’s a hard limit, not a setting.
Record the authority, not just the action
Auditors ask two separate questions: did it happen, and was it allowed? So each entry records the permission in force at that moment: the level, the time window, the approval used, or the emergency rule that applied. Every change to permissions is logged as well, so the authority behind any past action can be proven.
Secrets never go in the log
Logs are long-lived and widely read. Guardian scrubs secrets from tool output and errors before anything is written, and the model never sees plaintext credentials in the first place.
A diary humans actually read
Raw logs prove; diaries explain. Each day Guardian writes a plain-English entry: faults found, work done, what’s waiting for approval, security events and what’s planned for tomorrow. A fault register tracks repeat offenders, such as the third link drop on the same PC this month, which usually points to a cable or switch port.
“Fixed” has to mean re-tested
The most dangerous line in any ticket system is “resolved” on something that isn’t. Guardian can only close an incident as resolved when the system itself re-runs the original symptom check after the last change, and it passes. Work with no definable check closes as “pending manager confirmation”. Intermittent faults stay under watch for a confirmation window, and reopen if they recur.
Who uses the record
- Engineers picking up where the agent left off.
- Clients who want to see what they pay for.
- Auditors working through Cyber Essentials, ISO 27001 or GDPR evidence.
- Cyber insurers asking who changed what before an incident.
Want Guardian on your network? Join early access as a design partner.