Your audit log has 1,509 "allowed" rows. That is not evidence.

A public post in r/mcp made the gap concrete: an operator counted 1,509 audit rows since August, and every single row said allowed. Zero refusals.

That is not a success metric. It is a missing control.

What an audit log usually answers

Most logs answer what ran. Security teams and buyers ask a different question:

What did the agent try to do, and what was it told no?

If the answer is always "nothing was refused", one of two things is true: the policy is perfect, or there is no policy in the path. The first is rare. The second is common.

A refusal is a data model, not a log line

A useful denial record needs more than status: denied:

• actor — browser session or agent key;
• task — the envelope, budget, payee allowlist, expiry;
• policy — which rule fired and why;
• artifact hash — the exact input the decision was made on;
• decision and reason — deny, require_approval, or allow;
• signature — so a third party can verify the record offline;
• timestamp — append-only, not editable after the fact.

That is what Deny Evidence produces. The price is deliberately boring: $29/month. No custody. No token. No dashboard that asks you to trust a green checkmark.

What it does not prove

A signed refusal record proves what the gateway saw and decided. It does not prove the model's intent, and it does not replace a SIEM. If a tool bypasses the gateway, the record is incomplete. The honest claim is narrow: this is the evidence the enforcement point produced.

Why now

Agent payments are moving from demos to procurement. A buyer will ask for traces, approvals, and refusals. A log that only contains "allowed" is a liability disguised as observability.

If you run an MCP server, start by asking what a denied call looks like in your current logs. If the answer is "we don't have one", that is the first finding.

The portfolio

• Deny Evidence — signed refusal log, $29/month: https://attest.rta.lat/deny-evidence
• MCP Security Pass — $500 review before you expose a server: https://rta.lat/audit/
• EU AI Act Evidence Pack — $1,500 / 5 days; $3,000 / 72 hours: https://attest.rta.lat/eu-ai-act-evidence