You cannot show an auditor what your AI agents did.
Institutional due diligence questionnaires ask how agent activity is evidenced, and the allocation waits on the answer.
When an assessor asks, the honest answer today is a process description and a screenshot.
NOMARK is an open evidence protocol and an independent verifier for AI agent activity, built in Australia for APRA-regulated investment managers and super funds where an agent now touches a critical operation. Your auditor builds the verifier from source and runs it on a machine you control. It checks three shipped streams. Two of them must fail.
01 · SOLUTION.md
02
One line, and it stays on the file.
An institutional client sends an operational due diligence questionnaire before it allocates. One line asks which steps in the investment process are performed or assisted by automated agents, and how that is evidenced.
You answer it once. Your reviewer reads that answer again the next time they assess you.
Which steps in the investment process are performed or assisted by automated agents, and how is that evidenced?
A description passes the first review.
You write the process. You attach a screenshot of the console the agent runs in. Both are true.
Neither was built to be checked from outside. The records the agent left are not signed, not sequenced, and not checkable by anyone outside the system that wrote them.
The second review asks for the record behind the description. That is where the file stops.
04, standards/policy-packs/packs/apra-cps/sources/cps-230.txt, retrieved 2026-08-03
You have 24 hours, and the clock starts at the disruption.
Under CPS 230 you owe evidence of how a critical operation ran, including the parts an automated agent ran on your behalf.
An APRA-regulated entity must notify APRA as soon as possible, and not later than 24 hours after, if it has suffered a disruption to a critical operation outside tolerance.
Paragraph 32 sets a second window: 72 hours to notify an operational risk incident with a material financial impact, or a material impact on your ability to maintain a critical operation. Inside either one, you will not reconstruct an agent's behaviour from unsequenced logs across several systems. By the time you notify, the record exists or it does not.
An APRA-regulated entity must regularly monitor, review and test controls for design and operating effectiveness, the frequency of which must be commensurate with the materiality of the risks being controlled.
An assessor reads your control design in a document, then asks what the control actually did, on specific days, in production. Where a person performs the control, that person leaves an artefact behind and you hand it over. Where an agent performs it, you hand over a log. An engineer wrote that log to debug a failure.
05
An assessor asks three things.
Which actions ran.
On whose authority.
What stopped the actions that should not have run.
A console owned by the system under review answers none of them. CPS 234 asks the same question of access and change, and a control you cannot evidence is a control you cannot claim.
06, tasks/prd-decision-assurance-v0.1.md
An answer made of artefacts looks like this.
An agent emits a signed, sequenced record at the moment it acts. Those records hash-chain into a stream, so anyone holding the stream and the public keys can detect a removal or a reorder. Your auditor runs that check. We are not in the room.
It slots into the control library you already maintain. There is no new worldview to adopt and no console of ours to log into.
- 01
Agent action
An agent acts inside a governed operation.
- 02
Signed record
The agent signs and sequences the record where the action happened.
- 03
Chained stream
Each record carries the hash of the one before it, so a removal shows.
- 04
Independent verifier
Your auditor builds the verifier from source and runs it offline.
- 05
Assessor verdict
The verifier returns PASS or FAIL with NOMARK absent.
Collector scope: Decision Assurance direct-instrumentation reference workload; generic MCP stdio interposition, federation, high availability and managed key infrastructure remain open.
07, standards/policy-packs/tools/build-auditor-kit.cjs
Run it before you believe any of this.
A negative stream that verifies is a failed run, and the exercise reports that as plainly as a pass. Two of the three below are shipped conformance vectors, copied verbatim, and the verifier has to refuse both.
It runs offline on a machine you control. You need a Go toolchain and a clean checkout, no account and no request form.
| Stream | Expected verdict | Provenance | Source |
|---|---|---|---|
| streams/sample.jsonl | PASS | hand-authored at build time by standards/policy-packs/tools/generate-sample.mjs | standards/policy-packs/tools/build-auditor-kit.cjs |
| streams/tampered.jsonl | FAIL | the shipped tampered-payload conformance vector, copied verbatim | packages/protocol/vectors/invalid/tampered-payload.expected.json |
| streams/gap.jsonl | FAIL | the shipped sequence-gap conformance vector, copied verbatim | packages/protocol/vectors/invalid/sequence-gap.expected.json |
The kit's shipped streams and the verdicts the verifier must produce.
08
Every claim on this page has a file behind it.
Every number recomputes from the repository at build. A claim that stops being true fails the build rather than ageing quietly here. Anything that exists only as a specification is labelled as one. You are reading the state of the code, not a description of it.
The evidence format is an open wire protocol, and the verifier is a separate implementation that does not depend on the system that produced the records.
packages/protocol/
Read the protocolThe verification kit is built from source in this repository, so an auditor can run it without the vendor present.
standards/policy-packs/tools/build-auditor-kit.cjs
See the verification kitThe vendor assessment is written into this repository, including its security addendum, its subprocessor register and the items it cannot answer yet.
docs/vendor-assessment/
Read the vendor assessment09, docs/design-partner-kit/brief.md
Nothing in the record depends on NOMARK still existing.
The protocol is open and the verifier is a separate implementation. Records you hold verify on your own machines, with a verifier you built yourself, against a corpus you can read. No service of ours sits in that path.
You will be talking to one person. NOMARK is Reece Frazier, working alone. The background is fund administration in regulated financial services, which is the operation CPS 230 names as critical for an RSE licensee at paragraph 35(c). The company is pre-revenue and has no customers to name, and it is looking for three design partners.
Map the gap before an assessor does.
You leave with a gap map you own, in your own terms, covering the operations you name. It is not a proposal. You keep it whether or not you go further.
45 minutes with your risk or investment operations lead. We walk your CPS 230 critical operations, mark where agents act, and name what evidence exists today.
Email is faster than a calendar link. A short note describing the operation tells us more than a meeting request.
Derived at build from the repository this site is generated from. A claim that cannot be derived fails the build rather than reaching this page.