# Built to be checked, not just trusted

Trust and evidence: what looot guarantees about isolation, contracts, and audit, and what it doesn't claim.

## Tenant isolation

Every discover, inspect, and run call is scoped to one organization. No cross-tenant read or write path exists in the gateway.

## Versioned operation contracts

A provider or schema change never silently reshapes what a caller already integrated against; contracts are versioned and a caller pinned to an older version keeps working.

## Evidence, not claims

Hash-chained audit log -- every run is written to a tamper-evident, redacted log tied to one tenant.

Effect-aware retry -- an uncertain outcome is checked before it is retried, so a retry never produces a second charge for one effect.

Raw, canonical, and mapped output -- a run's result is available in all three forms with field-level provenance, not just a summary.

## What we don't claim

looot never reports a call as run, verified, or connected without a real receipt behind that claim. See it on your own workspace rather than take this page's word for it.