An audit trail tells you what happened. A tamper-evident audit trail lets you prove it — to a customer, an auditor, or a court — even when someone had every incentive and opportunity to rewrite it.
The problem with ordinary logs
Every AI agent framework already produces logs. LangChain prints traces, your orchestrator writes rows to Postgres, your cloud provider keeps request logs. All of them share one property: someone with write access can change them afterwards — and nothing in the log itself would reveal the edit.
That is fine for debugging. It is not fine for the moment an agent issues a $40,000 refund it shouldn't have, leaks a credential, or deletes customer data. At that moment the question stops being "what does the log say?" and becomes "can you prove the log wasn't edited after the fact?" Ordinary logs cannot answer that. Their integrity rests entirely on access controls and trust — both of which are exactly what an incident puts in doubt.
What "tamper-evident" actually means
Tamper-evident does not mean tamper-proof. No software can stop a sufficiently privileged attacker from altering stored bytes. Tamper-evident means any alteration leaves detectable evidence — the forgery is mathematically exposed the next time anyone checks.
The standard construction is a hash chain. Each record stores:
- its own payload (what the agent did, when, with what tool),
- the hash of the previous record (typically SHA-256),
- its own hash, computed over the previous hash plus its payload.
Record 100 therefore cryptographically commits to records 1–99. Change a single character in record 50 and its hash changes — which invalidates the stored "previous hash" in record 51, which invalidates 52, and so on down the line. To forge history convincingly, an attacker must recompute every subsequent hash — and anyone holding an independent copy of any later hash (an exported CSV, a minted certificate, a public badge state) can expose the forgery instantly.
Append-only is the other half
A hash chain alone is not enough if old records can be deleted: an attacker could truncate the chain and re-anchor it. So a tamper-evident ledger must also be append-only — the system offers no edit or delete operation on records, only insertion. Verification then checks two things: every link recomputes correctly, and the sequence numbers run unbroken from genesis.
This is the same idea behind certificate-transparency logs and, at a much larger scale, blockchains — minus the consensus machinery, which a single-operator audit trail doesn't need. What it needs is a one-click verification that recomputes every hash server-side and reports PASS/FAIL with the exact break point, so a non-cryptographer can check integrity in seconds.
What makes it "for AI agents" specifically
Generic tamper-evident logging (think financial audit logs) records events. An AI-agent audit trail records agency: tool calls with their inputs and outputs, decision points with the reasoning summary, and the causal links between them. The payload schema matters — agent_id, action_type, tool_name, input/output summaries, and metadata — because post-incident questions are always of the form "which tool call caused this outcome, and what did the agent know at the time?"
Three properties separate a real agent audit trail from a log file with hashes bolted on:
- Independent verification. Anyone — not just the operator — can re-verify. Public endpoints and signed certificates move trust from "believe our dashboard" to "check the math yourself."
- Evidence-grade exports. CSV dumps where each row's
prev_hashequals the previous row'shash, and printable reports with scope, methodology, and an integrity statement — the shape auditors expect. - Detection on top. The same stream that proves the past can watch the present: burst detection, first-seen tool alerts, after-hours flags. Evidence and monitoring from one tape.
What tamper-evidence does not do
Honesty matters here. A hash chain proves the record wasn't altered; it says nothing about whether the record was true when written. If your agent lies in its output summary, the ledger preserves the lie perfectly. Tamper-evidence also doesn't prove completeness — an agent that silently skips logging its worst action leaves no gap the chain can detect. (Mitigation: log at the tool-execution layer, not inside the agent's own code, and alert on sequence gaps.)
And verification is only as independent as your copies: if the only copy of the chain lives on infrastructure the attacker controls, they can rewrite it wholesale. Export regularly, mint certificates, and keep at least one copy somewhere the operator can't silently rewrite.
The one-paragraph version
A tamper-evident audit trail for AI agents is an append-only ledger where each action record cryptographically commits to all previous records via SHA-256 hash chaining, with one-click server-side verification, evidence-grade exports, and anomaly detection on top. It answers the incident question — can you prove what your AI did? — with math instead of trust.