12How to
How do you make an AI agent audit trail tamper-evident?
No log is tamper-proof. Make your audit trail tamper-evident, so any change or deletion can be detected. Sign each record when it is written, chain each record to the record before it, keep the signing key and a copy away from the agent and from the team it reports on, and copy the records to write-once storage.
Then check the signatures and the chain on a schedule. A chain nobody checks detects nothing.
Why is the agent's own log not enough?
A log written by the agent, or by a tool the agent can reach, can be changed by the same access that wrote it. It is useful for debugging and weak as evidence.
6 steps
- Write each record when the decision is made, outside the agent.
- Sign each record. A valid signature shows it has not changed since it was signed, while the key stays safe.
- Chain the records: put the hash of the previous record in each new record, so a deleted or reordered record breaks the chain.
- Keep the signing key and a copy away from the agent and from the people the records describe.
- Copy the records to write-once storage as soon as you can.
- Check the signatures and the chain on a schedule, and alert on a gap.
What OWASP advises
OWASP's Logging Cheat Sheet advises building in tamper detection, so you know when a record was changed or deleted, and to “store or copy log data to read-only media as soon as possible.”
What tamper-evident does not show
- That nothing was left out. A chain cannot show an event that was never written.
- That the content was true. A signature shows which key signed, not that the statement was right.
- That the action happened. That needs a check of the system that holds the result.
Where TrustGate fits
TrustGate returns a signed allow, deny or escalate decision before the action runs, for actions that go through it. The receipt binds the agent, action, target and exact arguments that were evaluated. It records whether approval was asserted, not who approved.
Every decision receipt is Ed25519-signed; production also adds an ML-DSA-65 (FIPS 204) co-signature. A third party should check a receipt against a key published at /.well-known/did.json, not a key carried in the receipt itself. Not every earlier receipt was signed under a published key.
What this page is not
- Not tamper-proof. No record is.
- Not a replacement for your logs or your storage.
- Not a lock. Signatures prove and detect. They do not prevent.
Quick answers
What is the best way to create a tamper-proof audit trail for AI agent actions?
Aim for tamper-evident, because no log is tamper-proof. Write each record outside the agent when the decision is made, sign it, chain it to the record before it, keep the key and a copy away from the agent, copy it to write-once storage, and check the chain on a schedule.
What is the difference between tamper-proof and tamper-evident?
Tamper-proof claims a record cannot be changed. Nothing digital meets that. Tamper-evident means a change or deletion can be detected, by a broken signature or a broken chain.
Is a hash chain enough?
No. It cannot show an event that was never written. Anyone who can rewrite the records from an edited record onward can rebuild the chain from that point. What exposes a rebuild is the latest hash, kept somewhere that writer cannot change. Sign the records and keep a copy elsewhere.
Sources
Each source was read on October 13, 2026. Wording in quotation marks is exact; the rest is paraphrase.
- Logging Cheat Sheet · OWASP Cheat Sheet Series · No date shown on the page