AI Agent Audit Trails: How to Prove What an Agent Did
Could you prove a year from now what your agent paid, and who signed? Not if the agent can edit its own log.
IN 30 SECONDS
An audit trail is the record of what each agent did, when, and on whose approval. A hash chain checked against a protected checkpoint makes edits show, and red-teaming tests the agent’s limits.
KEY TAKEAWAYS · 3
- An audit trail is evidence: what the agent did, on whose approval and why, in a log it can’t rewrite.
- A hash chain only detects edits against a trusted checkpoint, so protect signed checkpoints separately.
- Red-team your own agents on their real scope. A passing case tests only the boundary it exercised.
On this page
Why the audit trail has to be tamper-evident
IN SHORT If an agent moved money, you must prove later what it did, and the agent must not be able to rewrite that record.
WORDS TO KNOW
- Audit trail
- The record of what each agent did, when, and on whose approval, kept so it can be checked later.
- Hash
- A short fingerprint of some data. Change one character of the data and the fingerprint changes.
- Red-teaming
- Attacking your own system on purpose, the way an attacker would, to find the gaps first.
People hear “Audit trail The record of what each agent did, when, and on whose approval, kept so it can be checked later. See the glossary” and picture a log file. In regulated finance it’s closer to evidence: what the agent did, on whose approval and why. I design as if the auditor assumes bad faith.
A log the agent could quietly edit is worth nothing in that room. My proposed pattern: each entry records one action and carries the Hash A short fingerprint of some data. Change one character of the data and the fingerprint changes. See the glossary of the entry before it.
STEP BY STEP
Step 1. Write. Entry 7 records one action, its approver and the hash of entry 6.
- Write Entry 7 records one action, its approver and the hash of entry 6.
- Edit Someone changes the amount in entry 7. Its hash changes too.
- Snap Entry 8 still holds the old hash of entry 7, so the link no longer matches.
- Verify Recomputed and compared with a protected checkpoint, the chain fails from entry 7 on.
A hash chain only detects changes against a trusted checkpoint, such as a signed copy of a recent hash kept where the log’s writer can’t reach it.
WATCH OUT
Someone who can replace the whole log can recompute an unsigned chain, so protect signed checkpoints separately, restrict write access and verify against them. Even then, the chain shows entries weren’t changed, not that every action was logged.
A blockchain keeps one shared history, under its own consensus and finality rules. It doesn’t say why an off-chain eligibility check said yes or no. So keep the policy version and the decision evidence next to each transaction.
Sources: signed log integrity validation, AWS CloudTrail.
Coming up next: So how do you check the limits before anyone relies on them?
Red-teaming agents I built in production
IN SHORT I have built guardrails and Red-teaming Attacking your own system on purpose, the way an attacker would, to find the gaps first. See the glossary agents in production, to find the gaps before an attacker does.
At Ilayer I built the agent platform for a US real-estate private-equity fund. I red-teamed it myself, with inputs made to push the agents out of scope, because “it behaved in the demo” is not a security argument.
WATCH OUT
A passing red-team case tests the boundary that case exercised. It does not show that an unseen injection or another execution path is contained.
At Integra I was CTO until that role ended in 2026. I deployed about 46 AI agents there for internal operations. They are separate from the fund platform’s production agents.
Approximate count, owner-reported
The approval flow and audit log in this episode are patterns built on that work. They don’t claim the fund platform used each mechanism exactly as shown.
IN PLAIN WORDS
No honest engineer can say “our agent can’t be injected.” With containment, you don’t need to beat injection, only to survive it.
ITEM GET
What you can stand behind
FAQ
No. Don’t assume a filter will stop every attack. Pair model-side defenses with permissions the agent’s systems enforce, test both, and plan for a compromised agent.
It helps, and you should run one. But you can’t assume it catches every attack: if it alone stands before a wire transfer, one miss moves money. With containment, the miss still needs a human signature.
The agent holds only what its current task needs, for as long as the task runs. In practice: one identity per task and short-lived keys, not one long-lived key it carries everywhere.
List every path that can move value or grant authority. Put them behind an independent approval that shows the signer the payee, amount and scope. People can be fooled too, so keep hard spending limits and test approval bypasses.
STAGE CLEAR
What you now know
- Why a log the agent can edit proves nothing.
- How a protected checkpoint makes an edit visible.
- What a passing red-team case does and doesn’t show.
Check yourself
Tap or click a question to see the answer.
Someone can replace the whole log, and no trusted checkpoint is kept out of their reach. Will an edit show?
No. They can recompute an unsigned chain. Only a trusted checkpoint out of their reach, like a protected signed hash, would expose it.
Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.
Have a project to ship or a role to fill?
Discuss your project or roleFollow the engineering notes
Get new articles on production AI and smart contracts by email.