Skip to main content

Gateway Evidence

The Entity Gateway sits between your agents and their model providers. Its ClawGRC exporter sends one event per model call to Claw GRC, which turns each event into a hash-chained audit record tagged with the controls it is evidence for. It is included on every plan (Starter, Growth and Scale) up to 1,000,000 events per month per organization.

Connect the exporter​

Create an agent API key (cgrc_...) in your workspace, then point the gateway's clawgrc exporter at the sink:

POST https://api.clawgrc.com/v1/gateway/events
X-API-Key: cgrc_...
Content-Type: application/json

The body is one entity-gateway-hook/1 event, or {"events": [...]} with up to 100 events:

{
  "events": [
    {
      "version": "entity-gateway-hook/1",
      "event": "request_complete",
      "metadata": {
        "did": "did:key:z6Mk...",
        "model": "claude-sonnet",
        "provider": "anthropic",
        "format": "anthropic_messages",
        "request_id": "req_123"
      },
      "tools": [{ "kind": "tool_use", "name": "search", "id": "call_1" }],
      "cost": { "input_tokens": 812, "output_tokens": 240, "nanodollars": 4100000 },
      "request_sha256": "…",
      "response_sha256": "…"
    }
  ]
}

Each event is answered with recorded, duplicate or rejected:

  • recorded: the event was appended to the audit chain.
  • duplicate: the same request_id and event was already recorded, so a retry is safe.
  • rejected: no active agent in your organization matches agent_id or the verified did. Register the agent first.

What is stored​

StoredNever stored
Model, provider, wire format, request id, session idRequest bodies
Token counts and costResponse bodies
Tool names and call idsTool inputs and tool results
SHA-256 hashes of the request and responseUser messages
Grant ids that allowed the call

Bodies are dropped on arrival. Only their hashes are kept, so you can prove later that a record matches a body you hold without Claw GRC ever having seen it.

Controls it evidences​

Every event is tagged with the controls it supports, shown with the framework slug.

EventControls
Every eventNIST AI RMF MANAGE 4.1, AIUC-1 E015, OWASP MCP08
pre_requestOWASP Agentic ASI03, OWASP MCP07, AIUC-1 B007
request_completeOWASP LLM10 monitoring
tool_callsOWASP LLM06 monitoring, OWASP Agentic ASI02, AIUC-1 B006, AIUC-1 D003

ISO 42001 evidence comes through the same records by the crosswalks between these frameworks. The dashboard's Gateway evidence tile shows events this month, top models, blocked or failed calls, and the controls covered.

Limits​

Past 1,000,000 events in a calendar month the sink answers 429 with a link to pricing. The count resets on the first of the month (UTC).