Keep Runlayer. Put the proof in Interlok.

Runlayer exports every audit event to S3. Interlok reads that export, signs each record the moment it arrives, and keeps it in a hash-chained ledger an auditor can verify offline, without trusting Runlayer or us.

Two ways to connect, used together for the strongest grade

Log ingest · G3

Point Interlok at the export bucket with a read-only key. Every five minutes it pulls new objects from audit-logs/year=…/month=…/day=…/, keeps the SHA-256 of each object exactly as Runlayer wrote it plus Runlayer's audit_log_id, and signs the record with receipt time and event time. The same event can always be checked against Runlayer's own log.

Chained observer · G2

Set a Runlayer connector's upstream to the URL Interlok gives you. Interlok forwards every call to your MCP server untouched and signs what reached the server and what came back. Credentials Runlayer injects are forwarded and dropped, never stored.

When an observed call and a Runlayer record describe the same call (same tool, same arguments or request id, within two minutes), Interlok writes a new G2+ corroborated entry joining them. If Runlayer recorded a denial for a call that still reached the server, Interlok records a discrepancy and alerts you.

What the grades mean

Grade	Proves	Blind spot
G1 native	Interlok decided the call and a person approved it	None
G2+ corroborated	Runlayer's verdict plus an independent witness of execution	Denials before execution rest on Runlayer's records
G2 observed	Exactly what reached the server and what came back	Decisions made inside Runlayer
G3 ingested	Interlok received this Runlayer record at this time, unaltered since	Whether the record is true

Approvals in Runlayer's log count as verified only when they name a human approver; an agent never approves an agent. High-risk tools that only have G2 or G3 evidence are flagged, with one click to move them onto Interlok's native gate.

Setup

Ask Runlayer to export audit logs to S3 (their bucket with a role you name, or yours).
Create an IAM user with s3:ListBucket and s3:GetObject on the export prefix only.
In Interlok: Connected sources → Connect a source → Log ingest → Runlayer. The key is stored encrypted.
Optional: add a chained observer for the servers you want witnessed (G2, and G2+ when matched).

Runlayer's public documentation does not list every field inside an audit record's details or every action type. Interlok keeps the action type verbatim, maps common field names, and lets you override the mapping per source. Check a sample export with us during setup. Runlayer is a trademark of its owner; this page describes an integration built on Runlayer's published export format and does not imply endorsement.

Evidence Connect pricing