Salmon EVI: your agent's own log is not evidence

Every AI agent audit log you have is written by the thing you are auditing. Archipelo's answer, announced September 25, is Salmon — Execution Verification Infrastructure, or EVI: cryptographically signed execution events chained into a record you can verify without trusting the agent's self-report. Whether or not you buy it, the design tells you what a defensible agent log actually needs.

What actually happened

From Archipelo's announcement:

• Salmon captures execution as signed events, records the resulting state transitions, and links them into what the company calls a Verifiable Execution Record.
• Each event carries the actor, the action, the state before and after, and a cryptographic signature. Events are linked to the prior one, so the chain is tamper-evident: altering or deleting an event breaks verification rather than quietly rewriting history.
• The output is described as machine-consumable execution evidence — meant to be checked by another system, not read by a human after an incident.
• Archipelo frames it as covering humans, AI agents and automation under one execution history, which matters because most real incidents cross that line.
• CEO and protocol architect Matthew Wise: "You cannot control autonomous systems without verifiable evidence of their execution."
• Archipelo is backed by Dell Technologies Capital, with individual investors including Zoom CEO Eric Yuan, Andy Bechtolsheim, Bill Tai and David Weisburd, plus Hack VC, Sangha Capital and Nima Capital.

Two honest caveats. The release names no pricing and no general-availability date, and it references "a cryptographic protocol" without naming or specifying it. Treat this as a design worth understanding, not a product you can price this week.

Why verifiable agent execution matters for your business

The gap is real and you probably have it. When an agent does something wrong, your evidence is almost always the agent's own transcript plus whatever your application happened to log. Both are written in the agent's trust domain. We have covered the consequence repeatedly this month: an OpenAI agent that routed around blocks on a government portal and took three months to surface, and agents that posted 53 user images publicly. In both cases the reconstruction came from the vendor's internal review, because nobody outside it had an independent record.

You can get most of this value without buying anything. Log agent actions to a sink the agent has no write path to — a separate account, append-only object storage with retention lock, or your SIEM — and record the action, the identity that took it, and the state before and after. Not just the prompt and the response. If your agent log lives in the same database the agent can write to, it is a diary, not an audit trail.

Signed and chained is the part that survives a dispute. The reason this category exists is that tamper-evidence changes what you can assert. "Our logs show the agent did X" is a claim about your logs. "Here is a signed chain, verify it yourself" is evidence a customer, an insurer or a regulator can check without taking your word for it. If you are selling agent-driven work to anyone in a regulated industry, that difference eventually shows up in a contract.

Ask your vendors what they can prove, not what they can show you. Agent governance is becoming a shopping list — identity, policy, runtime control, and now execution evidence. The question that separates products is narrow: can a third party verify your agent's execution record without trusting your infrastructure? Put it in your diligence template now. Most answers will be no, and knowing which vendors say so plainly is worth the email.

Sources: Archipelo / Salmon announcement (GlobeNewswire), Salmon.