Proof is not a log.
It is a receipt.
A log tells you what happened after it happened. A receipt proves — cryptographically, before execution takes effect — that what happened was authorized.
These are not equivalent. One is a description. The other is proof. Paste a receipt below and verify it without trusting Keon.
Verification uses only the receipt and a public key. Keon infrastructure is not involved.
The exact policy version active at execution is permanently bound into the receipt hash.
The receipt exists because governance happened before the action — not as documentation after it.
This is not a feature comparison. It is a question of what’s provable.
Does it prove the action was authorized?
No. A log records what happened. It does not prove it was permitted.
Yes. A receipt is issued before the action takes effect — authorization is structural, not inferred.
Can it be independently verified?
No. Verification requires access to the original system to confirm the log is authentic.
Yes. Verification requires only the receipt and a public key. No Keon infrastructure needed.
Is it tamper-evident?
No. Logs are mutable. A modified log is indistinguishable from an original without external controls.
Yes. Ed25519 signature binding makes any modification immediately detectable.
Does it bind to a specific policy version?
No. A log entry cannot prove which policy version was active at execution time.
Yes. PolicyHash is permanently bound to the receipt at issuance. The exact policy is provable.
Can it answer "what would have happened with different inputs?"
No. Logs record what did happen — they cannot answer counterfactual audit questions.
Yes. Deterministic policy evaluation means the same inputs under the same policy always produce the same decision.
“When an auditor asks who authorized this — a log answers with a timestamp. A receipt answers with a signed, policy-bound decision that existed before the action took effect. Only one of them is proof.”
The verification tool above uses a canonical receipt. In production, every Keon execution produces receipts with the same cryptographic guarantees — against your policy, verified independently, without calling home.