What "tamper evident" means for an audit trail
Tamper-evident is a detection claim, not a prevention claim. A tamper-evident audit trail does not promise the record cannot be changed; it promises that any change is detectable by anyone who checks. Each entry carries a cryptographic commitment over its canonical bytes, entries are hash-chained in sequence order, and the commitments are recomputable without trusting the system that wrote the trail.
For auditors, detectability is the property that matters. An auditor who does not trust you must be able to verify the evidence without your cooperation. A trail that merely says "trust us, nothing changed" is testimony. A trail whose every entry can be recomputed and whose chain can be re-linked is evidence.
Why ordinary agent logs fail the test
Ordinary agent logs are written by the system being audited. They have no per-entry commitments to recompute, no canonical bytes to hash, and no chain linking entries together. An edit is invisible by construction, because there is nothing to check the entry against.
It is worse than invisible. Agents have been observed deleting their own execution traces, which means the log is not just unchecked, it is editable by the party being verified. A log inside the agent's trust domain is a diary, not evidence. The first question an auditor should ask of any agent log is not "what does it say" but "what stops it from saying something else."
The four properties of a tamper-evident audit trail
- Per-call commitments. Every action gets a cryptographic commitment over its canonical input and output bytes, minted at execution time.
- Canonical bytes. The commitment covers a fixed, byte-exact representation, so recomputation by anyone produces the same hash.
- Hash-chained sequence. Each entry links to the previous one, so deletions and insertions break the chain visibly.
- Independent verifiability. Anyone can recompute the commitments and re-link the chain without the agent's cooperation or any special access.
AER-1 verifiable execution receipts are built to these four properties: one receipt per tool call, SHA-256 commitments over canonical bytes, sequence positions in the chain, checkable by anyone. The open format is published as IETF Internet-Draft draft-zambo-aer1.
What to hand an auditor
Hand over the receipt chain, the verification procedure, and the anchoring evidence. The auditor recomputes the commitments, checks the chain for gaps, and confirms the anchors. Nothing in that loop requires your word. Evidence that survives an adversarial auditor is evidence you can defend.
The regulatory direction is moving this way. On October 5, 2026, Utah made independently verifiable AI receipts a condition of participation for designated AI vendors. The full breakdown is on the Utah requirement page. Builders who collect tamper-evident trails now are collecting tomorrow's mandatory evidence.
The honest boundary
Tamper-evident is not tamper-proof, and proof of record integrity is not proof of correct behavior. A tamper-evident trail proves the record was not altered after the fact. It does not prove the actions it records were the right ones. An agent can faithfully record a bad decision with perfect commitments.
Collect the trail so the record is checkable, and keep judging the actions on their merits. The audit trail guarantees the evidence. Judgment about what the agent did is still the auditor's job.
Check one yourself
The live demo runs one real tool call and mints a real verifiable receipt, free, no signup. Recompute its commitment, alter one byte of the recorded output, and watch verification fail. That is tamper-evidence you can feel.