ISO 27001 audit evidence architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · ISO/IEC 27001:2022 · layout control_review · implementation executed in CI before publish

The control that resolves this is an Attestable Inference Plane, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is ISO/IEC 27001:2022, and the question it actually asks is is this risk on the register with a named owner and a treatment. The shape below holds p95 ≤ 600ms over gRPC with mTLS, and ships with a standard-library implementation that runs as written.

The architecture friction point

The model works and the pilot passed. The rollout is stopped by a control gap: the team can show that inference happened, but cannot produce per-tenant, tamper-evident evidence of WHAT was processed, by WHOM, under WHICH retention rule — which is the evidence an auditor asks for and a shared application log cannot give.

What ISO/IEC 27001:2022 specifically requires

ISO 27001 is a management-system standard: the auditor checks that risks are identified, owned, treated and reviewed on a cycle. A perfect technical control that is absent from the risk register is a nonconformity.

The artifact that satisfies it is risk register entries with owners, treatments and review dates. The way teams most often fail it: a technically sound control that no Statement of Applicability references, so it cannot be evidenced.

Risk register with acceptance criteria

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Technical parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Review questions and answers

• Where is this control in the risk register and the Statement of Applicability, who owns it, and when was it last reviewed?
  Register entries are generated from the deployed control set, so every control has an SoA reference, a named owner and a review date that cannot silently lapse.
• Can you produce, for one named tenant, every inference record in a date range with proof none was altered?
  Yes — the verifier endpoint replays that tenant's hash chain for the date range and reports the first index at which the chain breaks. Each record commits to the previous record's digest, so an edit or deletion is detectable rather than merely unlikely.
• Where exactly in the request path are sensitive values removed, and what is stored in their place?
  In the redaction stage, before the record is sealed. Sensitive values are replaced with a sha256 digest of the value, so you can still prove which payload was processed without retaining the payload.
• Which key seals the records, who can use it, and what happens to verification after rotation?
  An HMAC key held in your KMS, usable only by the sealing service. Each record stores the key id it was sealed with, so the verifier resolves historical records against the KMS key history and rotation does not invalidate past evidence.
• What is the retention clock per data class, and what evidence proves deletion occurred?
  A retention clock per data class, enforced by the retention scheduler, which writes a deletion record when a record passes its horizon. The deletion log is what you show the auditor; reconcile it monthly against records in the store.
• Can tenant A's records ever appear in tenant B's evidence pack, and what makes that structurally impossible?
  No. The chain is keyed per tenant and the verifier rejects any record whose tenant_id does not match the stream being verified, so isolation is structural rather than a WHERE clause that can be forgotten.

The request path

Attestable Inference Plane — the request path, with the decision points that must exist before the first model call:

flowchart LR
    C[Client / Agent] --> G[Gateway]
    G --> PDP{Policy Decision Point<br/>tenant - class - purpose}
    PDP -->|deny| D[403 + denial record]
    PDP -->|allow| R[Redaction stage<br/>values to digests]
    R --> M[Model provider]
    M --> S[Seal: sha256 chain + HMAC]
    S --> L[(Per-tenant audit store)]
    L --> V[Verifier endpoint]
    V --> A[Auditor evidence pack]
    L --> RT[Retention scheduler]
    RT -->|expiry| X[Documented deletion]

The parts you have to build

1. Policy decision point — Evaluates tenant, data class and purpose before the call. Fails closed.
2. Redaction stage — Strips sensitive values and substitutes digests, BEFORE anything is sealed.
3. Per-tenant hash chain — Each record commits to the previous digest, keyed per tenant.
4. HMAC seal — A KMS-held key makes records unforgeable by anyone with store write access.
5. Retention scheduler — Enforces the per-class retention clock and records the deletion.
6. Verifier endpoint — The function you run in front of the auditor to prove the chain is intact.

Reference implementation — Per-tenant tamper-evident audit chain

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind gRPC with mTLS; the failure mode it guards against is a half-open HTTP/2 stream silently dropping the deadline. The output you hand the assessor is the Statement of Applicability extract.

"""Per-tenant, tamper-evident audit log for an LLM gateway.

Why this shape: a SOC 2 auditor does not ask "do you log?" — they ask whether a
log entry can be altered after the fact without detection, and whether tenant A
can ever read tenant B's entries. A plain append-only table answers neither.

This answers both with a per-tenant hash chain: each record commits to the
previous record's digest, so any edit or deletion breaks the chain at a
detectable point, and the chain is keyed per tenant so isolation is structural
rather than a WHERE clause someone can forget.
"""
import hashlib
import hmac
import json
import os
import time
from dataclasses import dataclass, field


GENESIS = "0" * 64


def _canonical(obj) -> bytes:
    # Digests must be stable across processes and Python versions, so the JSON
    # has to be canonical: sorted keys, no insignificant whitespace.
    return json.dumps(obj, sort_keys=True, separators=(",", ":")).encode()


@dataclass
class AuditChain:
    """Append-only, per-tenant hash chain with an HMAC seal.

    secret: a per-deployment key from your KMS. It makes the seal
    unforgeable by anyone who only has write access to the store.
    """
    secret: bytes
    heads: dict = field(default_factory=dict)   # tenant_id -> last digest

    def append(self, tenant_id: str, event: dict) -> dict:
        if not tenant_id:
            raise ValueError("tenant_id is required: an unattributed audit "
                             "record cannot satisfy per-tenant evidence")
        prev = self.heads.get(tenant_id, GENESIS)
        record = {
            "tenant_id": tenant_id,
            "ts": event.get("ts") or time.time(),
            "actor": event.get("actor"),
            "action": event["action"],
            "resource": event.get("resource"),
            "prev": prev,
            # Redaction happens BEFORE sealing. Sealing a payload you later
            # need to redact forces you to break your own chain.
            "payload": redact(event.get("payload") or {}),
        }
        digest = hashlib.sha256(_canonical(record)).hexdigest()
        seal = hmac.new(self.secret, digest.encode(), hashlib.sha256).hexdigest()
        record["digest"] = digest
        record["seal"] = seal
        self.heads[tenant_id] = digest
        return record

    def verify(self, tenant_id: str, records: list) -> tuple:
        """-> (ok, first_broken_index). This is the function you demo to the
        auditor; without it the chain is a claim rather than evidence."""
        prev = GENESIS
        for i, r in enumerate(records):
            if r.get("tenant_id") != tenant_id:
                return False, i          # cross-tenant record in the stream
            body = {k: r[k] for k in
                    ("tenant_id", "ts", "actor", "action", "resource",
                     "prev", "payload")}
            if r.get("prev") != prev:
                return False, i
            if hashlib.sha256(_canonical(body)).hexdigest() != r.get("digest"):
                return False, i
            expect = hmac.new(self.secret, r["digest"].encode(),
                              hashlib.sha256).hexdigest()
            if not hmac.compare_digest(expect, r.get("seal", "")):
                return False, i
            prev = r["digest"]
        return True, -1


SENSITIVE_KEYS = {"prompt", "completion", "email", "ssn", "dob", "mrn",
                  "card", "iban", "phone", "address", "name"}


def redact(payload: dict, keep_hash: bool = True) -> dict:
    """Drop sensitive values, keep a digest so you can still prove WHICH
    payload was processed without storing the payload itself.

    This is the control that lets you keep audit evidence under GDPR data
    minimisation and an HIPAA BAA at the same time."""
    out = {}
    for k, v in payload.items():
        if k.lower() in SENSITIVE_KEYS:
            out[k] = ("sha256:" + hashlib.sha256(
                _canonical(v)).hexdigest()[:16]) if keep_hash else "[redacted]"
        elif isinstance(v, dict):
            out[k] = redact(v, keep_hash)
        else:
            out[k] = v
    return out


if __name__ == "__main__":
    chain = AuditChain(secret=os.environb.get(b"AUDIT_HMAC_KEY", b"dev-only-key"))
    stream = [
        chain.append("tenant-a", {"actor": "svc:rag", "action": "inference",
                                  "resource": "gpt-4o",
                                  "payload": {"prompt": "patient MRN 9912",
                                              "tokens": 318}}),
        chain.append("tenant-a", {"actor": "u:42", "action": "export",
                                  "resource": "conversation/77"}),
    ]
    print("redacted payload:", stream[0]["payload"])
    print("chain verifies:", chain.verify("tenant-a", stream))
    stream[0]["payload"]["tokens"] = 1          # tamper
    print("after tamper:   ", chain.verify("tenant-a", stream))

The ISO/IEC 27001:2022 control, as code

Statement of Applicability with operating evidence. This is the artifact an assessor asks for under ISO/IEC 27001:2022 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Annex A control to evidence mapping behind a Statement of Applicability.

ISO/IEC 27001:2022 turns on the SoA: every Annex A control is either applicable
with a justification and evidence, or excluded with a justification. The audit
failure is an applicable control whose evidence is a policy document rather
than a record that the control operated.
"""

ANNEX_A_2022 = {
    "A.5.23": "Information security for use of cloud services",
    "A.8.2": "Privileged access rights",
    "A.8.10": "Information deletion",
    "A.8.12": "Data leakage prevention",
    "A.8.15": "Logging",
    "A.8.16": "Monitoring activities",
    "A.8.24": "Use of cryptography",
    "A.8.28": "Secure coding",
}

EVIDENCE_KINDS = {"record", "configuration", "test_result"}
NON_EVIDENCE = {"policy", "intent", "roadmap"}


class StatementOfApplicability:
    def __init__(self, scope: str):
        self.scope = scope
        self.entries: dict[str, dict] = {}

    def apply(self, control: str, justification: str,
              evidence_ref: str, evidence_kind: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if evidence_kind in NON_EVIDENCE:
            raise ValueError(
                f"{control}: {evidence_kind!r} describes intent, not operation")
        if evidence_kind not in EVIDENCE_KINDS:
            raise ValueError(f"{control}: unknown evidence kind {evidence_kind!r}")
        self.entries[control] = {"applicable": True, "justification": justification,
                                 "evidence_ref": evidence_ref,
                                 "evidence_kind": evidence_kind}

    def exclude(self, control: str, justification: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if len(justification.split()) < 5:
            raise ValueError(f"{control}: exclusion needs a real justification")
        self.entries[control] = {"applicable": False, "justification": justification}

    def unaddressed(self) -> list[str]:
        return sorted(set(ANNEX_A_2022) - set(self.entries))

    def certifiable(self) -> dict:
        gaps = self.unaddressed()
        applied = [c for c, e in self.entries.items() if e["applicable"]]
        return {"scope": self.scope, "applied": sorted(applied),
                "excluded": sorted(c for c, e in self.entries.items()
                                   if not e["applicable"]),
                "unaddressed": gaps, "certifiable": not gaps}


if __name__ == "__main__":
    soa = StatementOfApplicability("LLM platform, production tenant")
    soa.apply("A.5.23", "Model inference is a cloud service",
              "cfg://gateway/allowed-providers.yaml", "configuration")
    soa.apply("A.8.2", "Operators hold privileged access to prompts",
              "rec://iam/quarterly-access-review-2026Q3", "record")
    soa.apply("A.8.10", "Retention is enforced on prompt logs",
              "test://retention/expiry-suite-2026-10", "test_result")
    soa.apply("A.8.12", "Egress to model providers can leak data",
              "cfg://dlp/egress-classifier.yaml", "configuration")
    soa.apply("A.8.15", "All inference events are logged",
              "rec://audit/chain-head-2026-10-16", "record")
    soa.apply("A.8.16", "Anomalous usage is monitored",
              "rec://siem/llm-usage-alerts", "record")
    soa.apply("A.8.24", "TLS and at-rest encryption",
              "test://crypto/tls-config-scan", "test_result")
    soa.exclude("A.8.28", "No application code is developed within this scope "
                          "boundary; the platform is configured, not coded")

    report = soa.certifiable()
    assert report["certifiable"], report
    assert len(report["applied"]) == 7 and len(report["excluded"]) == 1, report

    try:
        soa.apply("A.8.15", "we have a logging policy",
                  "doc://policies/logging.pdf", "policy")
        raise AssertionError("accepted a policy document as operating evidence")
    except ValueError:
        pass

    partial = StatementOfApplicability("partial")
    partial.apply("A.8.15", "logging", "rec://x", "record")
    assert not partial.certifiable()["certifiable"]
    assert len(partial.certifiable()["unaddressed"]) == 7

    print("ISO/IEC 27001:2022 SoA evidence mapping: OK")
    print(f"  applied {len(report['applied'])}, excluded {len(report['excluded'])}, "
          f"unaddressed {len(report['unaddressed'])}")

Primary sources

This page exists because the problem is reported publicly. The threads below are the primary sources, linked unmodified and not affiliated with this site.

• Coding agents could make free software matter again hackernews · hn/comment · 2026-03-30
• ScanSkinAI hackernews · hn/comment · 2026-04-30

See also

• Part of enterprise ai compliance architecture.
• The same control appears in EU AI Act audit evidence architecture for enterprise LLM deployment.
• ISO/IEC 27001:2022 audit evidence architecture for enterprise LLM applies the same mechanism under a different obligation.
• PCI DSS 4.0 audit evidence architecture for enterprise LLM deployment applies the same mechanism under a different obligation.
• This pattern also governs SOX audit evidence architecture for enterprise LLM deployment.
• If this is the blocker in front of you: enterprise AI infrastructure review.