How to make agent actions auditable

1. Why this guide matters

Auditability is mostly about disciplined context capture. If you can show what the agent asked to do, what policy said, and what happened next, you are already far ahead.

This guide stores the NORNR decision next to the workflow output so future review does not depend on memory.

2. Install what you need

npm install @nornr/sdk

This guide uses the hosted NORNR path at https://nornr.com, so you can validate the decision flow without standing up the full local stack first.

3. Create the governed wallet

import { Wallet } from "@nornr/sdk";

const wallet = await Wallet.create({
  owner: "audit-agent",
  dailyLimit: 50,
  requireApprovalAbove: 20,
  baseUrl: "https://nornr.com",
});

This wallet is the mandate. It sets the budget and review threshold before the framework-specific workflow is allowed to continue.

4. Apply it in the workflow

const decision = await wallet.pay({
  amount: 11,
  to: "openai",
  purpose: "model inference",
});

await saveAuditEnvelope({
  workflowRunId,
  decision,
  actor: "audit-agent",
  createdAt: new Date().toISOString(),
});

The key pattern stays the same across frameworks: ask NORNR for a decision first, then let the expensive or externally billable step run only if policy says yes.

5. What to expect

• approved means the workflow can continue immediately inside its mandate.
• queued means the request crossed an approval threshold and should wait for review.
• rejected means policy did not allow the action to proceed.

That three-way split is what makes the pattern useful: low-risk work stays fast, higher-risk work becomes reviewable, and clearly out-of-policy work never leaves the workflow.

6. Where to go next

• Hosted quickstart
• Control room
• Guides library