What are tamper-evident AI agent logs?

A tamper-evident AI agent log records every action an agent took, where each entry carries a cryptographic commitment over its canonical bytes. Edits, deletions, and insertions break verification, so anyone holding the log can detect tampering without trusting whoever kept it.

What is the difference between tamper-evident and tamper-proof agent logs?

Tamper-evident means tampering is detectable: any change breaks verification and shows up when the log is checked. Tamper-proof means tampering is structurally impossible from the agent's position, which requires the record to be minted outside the agent's reach. Tamper-evidence is the audit property; tamper-proof is the stronger architectural claim.

How can I tell whether an agent log has been tampered with?

Recompute the commitments. In a tamper-evident log each entry carries a SHA-256 commitment over canonical bytes and commits to the previous entry. If any byte of any entry was altered, verification fails at exactly that entry. If an entry was deleted, the sequence shows a visible gap.

Why are ordinary agent logs not tamper-evident?

They are written by the agent's own runtime inside the agent's trust domain, with no cryptographic binding between entries and events. Anything the agent can see it can rewrite, and after an incident the log is maintained by the system under suspicion. A 2026 study found 9 of 10 coding agent setups deleted their own session records when asked.

What makes an AER-1 receipt tamper-evident?

Each AER-1 verifiable execution receipt carries the canonical bytes of the observed tool result and a SHA-256 output commitment, minted by the execution layer at execution time. Anyone can recompute the digest and confirm the stored result was not changed. The open format is defined in the IETF Internet-Draft draft-zambo-aer1.

Can tamper-evident AI agent logs be used as audit evidence?

Yes, as the foundation of it. A tamper-evident log proves the saved record was not changed, which is what auditors check first: is this the record the system actually produced? What it does not prove is that the model was right or the action was desirable. Pair tamper-evidence with independent review of the actions themselves.

Tamper-Evident AI Agent Logs: Every Entry Checkable by Anyone

Tamper-evident, not tamper-proof

The two words are different promises, and the distinction matters. Tamper-evident means any change is detectable. Tamper-proof means change is structurally impossible. For audit purposes, detectability is the property that matters: an auditor does not need the log to be unchangeable, they need to know whether it was changed.

A log that is tamper-evident in name only, editable with no trace, is just a log. Most agent logs live there today: written by the agent's own runtime, inside the agent's trust domain, with nothing binding the entries to the events they claim to record.

Tamper-proof is the stronger claim

Tamper-proof records add a structural guarantee: the record is minted outside the agent's reach, so the agent never holds the pen. Read the tamper-proof activity log guide.

How tamper evidence actually works

Append-only entries. New entries are added; old entries are never rewritten in place.
Each entry commits to the previous one. A hash chain links every entry to its predecessor, so inserting or reordering entries breaks the chain.
A commitment per entry. SHA-256 over canonical bytes: tool, caller, timestamp, inputs, observed outputs. Change one byte and verification fails at exactly that entry.
Sequence numbers. Deletion shows up as a visible gap in the sequence, not a clean log.
Independent verification. Anyone holding the log recomputes the commitments. No account, no API key, no trust in the operator.

Tampering is not prevented. It is made visible. That is the whole idea, and for an auditor it is the only idea that matters.

What counts as evidence, and what does not

A log entry counts as evidence when anyone can recompute its commitment. A JSONL file on the vendor's server that only the vendor can read is a claim, not evidence. Audit any tamper-evident AI agent log with three questions. Who minted this entry? If the answer is the agent or its runtime, it is not tamper-evident. Can I recompute the commitment? If there is no commitment, or checking requires the vendor's private infrastructure, it is trust, not evidence. Would a deleted entry show up? If deletion is silent, the log is a highlight reel.

How AER-1 makes agent logs tamper-evident

AER-1, published as the IETF Internet-Draft draft-zambo-aer1, defines a verifiable execution receipt per tool call:

Which tool ran and which agent called it
Execution-time timestamp
Canonical input and output bytes
SHA-256 commitment over those bytes
Sequence position, so a missing record is a visible gap

Chain the receipts and the log is the receipts. Every entry is checkable, every gap is visible, and the agent never held the pen.

Cross-vendor verification is verified, not claimed: the independent AER-1 x Tanilo interop run checked an AER-1 receipt chain against real Tanilo values end to end on an independent implementation. Independent implementations are tracked in the public registry.

Hold a tamper-evident record yourself

The live demo mints a real AER-1 receipt for a real tool call, free, no signup. Try changing one byte and watch verification fail. That is what tamper evidence feels like.

Mint a tamper-evident record right now.