Every event attested before it is committed.
WeilStream is a governed event fabric for the agentic enterprise: a topic-based stream of events and receipts running natively on WeilChain. Publishers write OCSF events to topics, authorized consumers pull them under @secured access control with no standing credentials, and once an event lands it cannot be edited or purged.
An ordered log is not the same as a trustworthy one.
Kafka gives you ordered data, but an operator with the right access can still edit or purge it after the fact. The record depends on trusting the infrastructure and whoever administers it.
Kafka
Excellent event transport
- Trust sits with the operator of the cluster and its administrators.
- The producer is an authenticated principal holding a credential.
- Authorization is an ACL checked at the broker.
- History is a durable replicated log that an admin can rewrite.
- Built to survive infrastructure failures.
WeilStream
A record you can prove
- Every message is attested by a quorum before it is committed.
- The producer is an agent identity, not a shared credential.
- Authority is bound to the action and checked by @secured.
- History inherits WeilChain's tamper-evident state: ordered and unmodifiable.
- Built to tolerate participants that are faulty or hostile.
If all you need is reliable message transport between applications, use Kafka, and keep using it. WeilStream does not ask you to replace a Kafka estate. The agentically significant events, delegation, authorization, tool invocation, approval, execution and cost, flow through WeilStream and can then feed Kafka, SIEM, compliance systems and billing like any other source.
The test is simple. Name who you have to trust for the record to be true, then imagine proving it to someone who does not trust them.
Inside the stream, then across a fleet.
The first view walks through publish, attestation, the shape of a message and the Kafka comparison. The second puts a hundred agents on the stream and lets you inject a rogue one.
Both views are the original animations, restyled. Everything shown is illustrative. Hover an agent in the fleet view for its identity card, and toggle the scenarios in the first view to watch a Byzantine validator or an insider edit get caught.
One stream. Four buyers.
Downstream systems consume a record they can trust, rather than one they have to trust the pipeline to preserve.
Detect what an agent should not be doing
Suspicious behavior, unexpected data access, privilege misuse and actions outside an agent's intended scope, flowing into the SIEM as they happen.
Continuous evidence, not retrospective reporting
Regulators and auditors can be shown what happened and under what authorization without reconstructing events weeks later.
Coordination without polling
Agent A completes an action and Agent B reacts to it, loosely coupled through trusted events rather than constant polling of a central controller.
Cost attributed where it happened
AI usage and cost attributed by agent, model, application, workflow, department or business unit.
These are not four instrumentation systems. Identity, authorization, execution, provenance and cost travel with the event. Instrument once, and each team consumes the view it needs.
Beneath agent detection and response, not competing with it.
Agent detection and response products sit near an agent's decision loop to catch dangerous actions. WeilStream addresses a different layer.
Agent detection and response
The bodyguard
Prevention and intervention. It tries to stop the incident. Prevention can fail, and incidents can be disputed afterwards.
WeilStream
The tamper-evident camera
Evidence of what actually happened. The agent records what it attempted, the authorization layer records what it was permitted, detection records whether it intervened, and execution records what ran. WeilStream is the common record those claims are reconciled against.
Attestation, Kafka and consumers, answered.
What platform, security and compliance teams ask before they put agent events on a new stream.
What is WeilStream?
WeilStream is a topic-based event and receipt stream for agent activity that runs natively on WeilChain. Publishers write OCSF-formatted events to topics, authorized consumers pull them under @secured access control with no standing credentials, and every message is attested by a quorum before it is committed, so the proof travels with the message rather than depending on a trusted broker.
How is WeilStream different from Kafka?
Kafka is event transport inside an administrative trust domain, so an operator with the right access can edit or purge a topic after the fact. WeilStream commits each message under quorum attestation on WeilChain, which makes history ordered and unmodifiable and lets consumers verify each message themselves. Kafka is built to survive infrastructure failures; WeilStream is built to tolerate participants that are faulty or hostile.
Do I have to replace Kafka to use WeilStream?
No. Kafka can remain the high-volume operational messaging layer. The agentically significant events, such as delegation, authorization, tool invocation, human approval, execution, completion, cost and security intervention, flow through WeilStream and can then feed Kafka, SIEM, compliance systems and billing platforms.
Can an event be edited or deleted after it lands on a topic?
No. Once an event lands on a topic it inherits WeilChain's tamper-evident, immutable state. Altering a committed message would require forging a quorum's worth of attestations, which is detectable, rather than editing a broker's log.
What format are WeilStream events in?
Publishers write OCSF-formatted events, the Open Cybersecurity Schema Framework, so security, compliance and observability systems can consume them without a custom parser. Granted actions and refusals are both published, with a denial arriving as a finding rather than being dropped.
Who can read from a WeilStream topic?
Only consumers authorized under @secured access control. There are no standing credentials to steal, and each consumer group pulls at its own pace from its own offset, verifying the attestation on every message it reads.
How does WeilStream relate to agent detection and response tools?
WeilStream sits beneath them rather than competing with them. Detection and response tools try to prevent or intervene in dangerous actions; WeilStream is the tamper-evident record of what actually happened. Those tools can publish their own decisions into WeilStream, so the agent's attempt, the authorization, the intervention and the execution can all be reconciled against one record.
Which teams consume WeilStream?
Four at once: security detects misuse and out-of-scope actions, compliance and risk get continuous evidence, agent engineering uses trusted events for coordination without polling, and finance attributes AI cost by agent, model, workflow or business unit. Identity, authorization, provenance and cost travel with the event, so the stream is instrumented once.