Why a normal log is not enough
A text log can be edited after the fact. For an agent that moves files and spends money, you want a log where the database refuses UPDATE and DELETE, and where each entry chains to the one before it.
The chain, in one line
Each audit entry stores a SHA-256 hash of the previous entry. Change any record and every hash after it breaks. That is the tamper-evident part — you can verify the chain at any time.
What gets recorded
- The agent, the action, and the decision (allow / hold / block).
- The reason — an allowlist match, a risk tier, a budget check.
- Latency, tokens, and cost where relevant.
- The run id, so you can open the full trace.
Export and ownership
You can export the history as JSONL. That matters for compliance and for fine-tuning: your runs are yours, not locked in a vendor’s format.
When it pays off
A customer asks what happened at 2am. A regulator asks for evidence of a control. A teammate asks who approved a delete. Each answer is one query, and the answer is provable.