Your MCP gateway's audit log is useful for operations. An auditor, a customer questionnaire or a regulator needs something stronger: records nobody could have edited, a population nobody could have trimmed, and an honest statement of what each record proves.
| Gateway audit log | Interlok signed evidence | |
|---|---|---|
| Who can change a record after the fact | Whoever runs the log store | Nobody without breaking the hash chain and signature |
| How an auditor checks it | Trusts the export and the vendor | Verifies offline with a public key and an open-source verifier |
| Completeness | Whatever the export contains | Every record in range, linked by hash; gaps are detectable |
| Who holds the key | The vendor | Interlok by default, or your own key (customer custody) |
| What the record proves | Unstated | Graded: native, observed, ingested, corroborated |
| Approvals | Whatever the log says | Verified only when a named human approved; an agent never approves an agent |
| Calls the gateway blocked but that ran anyway | Invisible | Detected when an observed call contradicts a recorded denial |
| Across gateways | One vendor's view | One ledger for every gateway and Interlok's own gate |
Evidence Connect works with the gateway you already run. Chain Interlok behind it to witness what reaches your servers (G2), send or let Interlok pull its decision records (G3), and get corroborated evidence (G2+) where the two agree. The coverage report shows which high-risk tools still rest on another vendor's records, so you can move just those onto Interlok's native gate (G1), where a person approves and the decision is signed where it is made.
Signing a gateway's record does not make it true; it proves the record has not changed since Interlok received it. That is why every record carries its grade.