# Guides

Longer pieces for developers and for the people who review their work. Each one states the limit plainly: records are evidence, not certification.

Reference pages are in the [docs](/docs). For the change to make in one framework, see [For your framework](/docs/frameworks).

- [Why your own logs are not evidence](/docs/guides/why-your-own-logs-are-not-evidence): the edit, drop and backdate problems, what write-once storage and a SIEM add, and what a third party can check.
- [A tamper-evident audit trail for an agent in ten minutes](/docs/guides/audit-trail-in-ten-minutes): an agent with three tools, wrapped and declared, a verify run with its coverage line, and an export for an auditor.

Next: one page for each framework. [For your framework](/docs/frameworks)