What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A SHA-256 hash chain makes an AI agent’s audit log tamper-evident. Each record stores a digest computed from its own canonical content and from the digest of the record before it, so changing any earlier entry breaks every later link. That detection is only as strong as the place where the latest chain head is kept. If the agent runtime, the log writer, or a privileged operator can replace that head, they can recompute a consistent chain and the change goes unnoticed.
The design below has six parts: define the event record, canonicalize it into deterministic bytes, chain each record to its predecessor, write through a path the agent cannot reach, witness chain heads outside that path, and verify by recomputation.
As an Amazon Associate I earn from qualifying purchases.
What the chain proves, and what it does not
A chain makes a change detectable relative to a chain head or checkpoint that an attacker cannot silently replace. It does not make the log immutable, and it does not prove that a privileged operator never rewrote the entire chain. The Agent Control Standard Instrument Specification v0.1 (ACS) states the requirement directly: “The audit chain is only tamper-evident to an outside party if its head is committed where that party can see it.”
Several attacks sit outside what the chain itself can catch:
#1 Best Overall
- Altering an event before it reaches the logger, so the log faithfully records a false action.
- Disabling the logger or preventing writes altogether. A chain cannot detect events that were never recorded.
- Compromising the audit writer, which controls the hashing and append path.
- Rewriting every record and recomputing every checkpoint that a verifier trusts.
OWASP’s Agentic Protection and Trust Specification (APTS) auditability guide makes the same point from the implementation side: it warns against relying on a hash chain once the agent runtime has access to the audit store. Independent storage, key custody, and checkpoint witnessing decide which of these attacks remain detectable.
1. Define the event record before you hash anything
A hash can only protect what you chose to record. Decide which observable events matter, such as tool invocations, policy decisions, results, denials, and failures, and capture enough context to reconstruct them later. Instrument the trusted orchestration or control plane rather than relying on the model’s account of what it did. A model’s self-report is not a reliable record of which tools actually ran.
The Agent Audit Trail Internet-Draft (draft-sharif-agent-audit-trail-06, author Raza Sharif) proposes a JSON record format with input and output hashes and action categories. Its status is covered in the source table below. Treat its fields as a design checklist, not a mandated schema. A record should carry at least:
- event and session identifiers;
- agent identity, plus the human or service principal where relevant;
- a UTC timestamp and a sequence number within the chain;
- action type and outcome: allowed, denied, failed, or completed;
- tool name, and a digest of arguments and results rather than the raw content unless policy requires more;
- model, policy, and software version identifiers when reconstruction needs them;
- the previous-record hash and the current entry hash;
- a signature or checkpoint reference, where used.
Log denied and failed attempts as well as successful calls. A log that records only successful actions cannot show what a policy blocked.
{
"event_id": "evt_000184",
"sequence": 184,
"session_id": "sess_7f3a",
"timestamp_utc": "2026-10-09T14:03:22.418Z",
"agent_id": "agent:invoice-triage-02",
"principal": "svc:billing-orchestrator",
"action_type": "tool_call",
"tool": "payments.lookup_invoice",
"policy_decision": "allowed",
"policy_version": "2026-10-01.3",
"outcome": "completed",
"input_sha256": "9c1e4b7a0d2f…",
"output_sha256": "51d08e3b6a94…",
"previous_hash": "b7e2…",
"entry_hash": "4a90…"
}The digests in this example are shortened for display. A real SHA-256 digest is 64 hexadecimal characters.
2. Canonicalize the bytes you hash
JSON objects with identical data can be serialized differently. Key order, whitespace, number formatting, and string escaping all vary between libraries. If the writer and the verifier serialize the same record differently, verification fails even when nothing was tampered with. RFC 8785, the JSON Canonicalization Scheme (JCS), was published as an IETF RFC in November 2017 and defines a deterministic serialization that both sides can implement.
Document these decisions before the first record is written:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- the serialization rule (RFC 8785 JCS, or a documented equivalent) and the library that implements it;
- which fields are excluded from the hashed content;
- the exact byte concatenation used in the hash input, and its order;
- the digest encoding, such as lowercase hexadecimal;
- the genesis value for the first record;
- whether the chain is scoped per session or spans all agents.
3. Chain each record to its predecessor
Each record stores the hash of the record before it, and its own hash covers that value. ACS v0.1 specifies one concrete formula:
entry_hash = lowercase-hex(SHA-256(content_bytes || prev_hash_bytes))In that formula, content_bytes is the JCS canonical form of the record after entry_hash and previous_hash are removed. prev_hash_bytes is the raw bytes of the prior digest, and the first entry uses an empty byte string. The previous_hash field is still stored and checked during verification; it is excluded from the canonical JSON, but its raw bytes enter the hash input directly.
This is a rule of that specification, not a universal convention. Another format might hash the canonical record alone and check the link as a separate field. Whichever rule you choose, the verifier must implement exactly the same one.
The following sketch shows the ACS-style rule. The canonical function is a stand-in: json.dumps is not a full JCS implementation, so use an RFC 8785 library in production.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →import hashlib, json
def canonical_bytes(record):
# Stand-in only: replace with an RFC 8785 (JCS) implementation.
body = {k: v for k, v in record.items() if k not in ("entry_hash", "previous_hash")}
return json.dumps(body, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
def seal(record, prev_hash_hex):
prev = bytes.fromhex(prev_hash_hex) if prev_hash_hex else b""
record["previous_hash"] = prev_hash_hex
record["entry_hash"] = hashlib.sha256(canonical_bytes(record) + prev).hexdigest()
return record["entry_hash"]Genesis, scope, and failed writes
- Genesis: define the previous hash for record 1 (the ACS example uses an empty byte string) and the value a verifier expects to see.
- Scope: a per-session chain confines the effect of a broken link to one session. A global chain gives one order across all agents but needs a single writer or coordination to keep one sequence.
- Failed writes: decide what happens when an append fails. Failing closed blocks the action until the event is recorded. Failing open lets the agent continue but leaves an unlogged gap, which a verifier cannot see from the chain alone.
4. Write through a path the agent cannot reach
The agent process should hold no credentials that can rewrite, delete, or administer the authoritative log. Events go to a separate writer or control plane, which appends them to storage that enforces append-only semantics and retention. OWASP APTS identifies two common pitfalls: direct writes from the runtime, and audit-write credentials shared with the runtime.
Two stores often work better than one. A query-optimized store serves searches and dashboards, while an append-only store holds the authoritative records. The Agent Audit Trail draft describes this two-plane pattern. When you investigate, verify against the append-only plane, not the query copy.
5. Witness the chain head outside the agent’s reach
Periodically publish or sign the latest chain head to a destination that the runtime and the writer cannot silently rewrite, or hand a signed checkpoint to an outside observer. The verifier recomputes the chain from the records and compares the result with the witnessed head. A mismatch shows that records were edited, reordered, or truncated after the checkpoint.
The ACS specification also states that a private chain head can be rewritten, and that a holder of a symmetric key can re-sign a rewritten head. Witnessing therefore has to happen somewhere the writer’s own keys do not reach.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →HMAC or asymmetric signatures
If you sign checkpoints, the key model decides who can later be trusted to have produced them.
Best Value
| Property | Shared-secret HMAC | Asymmetric signature (for example ECDSA) |
|---|---|---|
| Who can produce a valid tag or signature | Every holder of the shared secret | Only the holder of the private key |
| Third-party verification | Requires sharing the secret, and anyone holding it can also forge tags | Verifiers need only the published public key |
| Offline verification | Possible only for parties holding the secret | Possible with distributed public keys; the AI Forensics Audit Trail Specification v1.0 draft uses a public JWKS for offline verification |
| Protection against the key holder | None against a holder of the secret | Depends on how the private key is custodied |
For independent verification, keep the private signing key with the trusted writer and distribute the public keys. The Agent Audit Trail draft describes optional ECDSA signatures. These are design descriptions in specifications, not evidence of how any deployment is secured.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Verify the log by recomputation
- Obtain the witnessed checkpoint from its independent destination, not from the log store.
- Read records from the append-only plane in sequence order, and confirm that sequence numbers are contiguous.
- For each record, confirm that previous_hash equals the prior entry_hash, with the genesis value for the first record.
- Recompute the canonical content and the chain formula, then compare the result with entry_hash.
- Compare the final head, and its sequence number, with the witnessed checkpoint.
- If signatures are used, verify them with the trusted public key.
def verify_chain(records, witnessed_head):
prev = ""
for r in records:
if r["previous_hash"] != prev:
return "link mismatch at sequence %s" % r["sequence"]
raw_prev = bytes.fromhex(prev) if prev else b""
recomputed = hashlib.sha256(canonical_bytes(r) + raw_prev).hexdigest()
if recomputed != r["entry_hash"]:
return "hash mismatch at sequence %s" % r["sequence"]
prev = r["entry_hash"]
if prev != witnessed_head:
return "head does not match witnessed checkpoint"
return "ok"Reading verification results
| Result | What it usually means | What to check next |
|---|---|---|
| Hash mismatch at sequence N | The content of record N differs from what was sealed, or the writer and verifier canonicalize differently | Compare the canonical bytes of record N from both sides and confirm the library versions match before concluding that a record was edited |
| Link mismatch at sequence N | Records before N were removed, inserted, or reordered, or previous_hash was altered | Check for sequence gaps and compare against the writer’s append logs |
| Chain verifies, head differs from checkpoint | Records were appended or removed after the checkpoint, or the checkpoint is stale | Compare the checkpoint’s sequence number with the record at that position |
| Chain verifies, head matches checkpoint | Records up to the checkpoint are unchanged relative to it | This does not show that every action was logged; events that never reached the writer leave no trace in the chain |
| Whole chain rewritten, witnessed head unchanged | The recomputed head no longer matches the checkpoint | Investigate the writer and storage access that made the rewrite possible |
| Whole chain rewritten, witnessed head also replaced | Not detected by the chain | Only an independently held or witnessed head that the attacker could not reach would reveal this case |
Protect content and privacy
Store the minimum that the audit purpose needs. Digests can commit to inputs and outputs without placing raw content in the record, but decide in advance:
- how an authorized investigator obtains the underlying content, and where that content is kept;
- who can access that store, and how those accesses are logged;
- retention periods for the records and for the underlying content.
A hash is not automatically anonymous. If the input space is small or predictable, someone can test guesses against a plain digest. Keyed hashing or salting belongs in the privacy review.
Deletion is a design choice in its own right. If the entry hash is computed from content you later delete, that record can no longer be recomputed. The Agent Audit Trail draft describes tombstone-based deletion, which replaces content with a marker. Decide before launch which fields the hash commits to, and what the tombstone retains, so that a lawful deletion can be told apart from tampering.
Self-managed design or hosted audit service
Whether you build the writer and storage yourself or buy an audit service, these six criteria determine how much integrity you actually get. The sources reviewed give design criteria only. They do not rank products or publish prices or performance figures, so the questions below are what to verify, not claims about any vendor.
| Criterion | Self-managed design must | Ask a hosted provider |
|---|---|---|
| Writer and storage credentials | Keep write, delete, and admin credentials away from the agent runtime | Who holds write, delete, and admin credentials, and could your runtime hold any of them? |
| Append-only enforcement | Enforce it in storage, not only in application code | Is append-only behavior enforced by storage, and can administrators delete records? |
| Independent head witnessing | Publish heads to a destination the writer cannot overwrite | Where are heads published, and can you retrieve them without the provider’s involvement? |
| Offline signature verification | Distribute public keys and keep private keys with the writer | Can a third party verify an exported log without calling the provider’s API? |
| Privacy, retention, and deletion | Define tombstones, retention periods, and access logging | Which deletion model is used, and how does it affect the chain? |
| Operational effort and interoperability | Own key rotation, storage, monitoring, and verifier maintenance | Which export formats and verification tools are supported? |
Standards and source status
| Source | Status as of 2026-10-09 | Use it for |
|---|---|---|
| RFC 8785, JSON Canonicalization Scheme (JCS) | IETF RFC, published November 2017 | A serialization reference for hashing JSON records consistently |
| Agent Audit Trail, draft-sharif-agent-audit-trail-06 (author Raza Sharif) | Individual Internet-Draft; the IETF Datatracker lists an update dated 2026-09-29 | A proposal for record format, input and output hashes, action categories, two-plane storage, and optional ECDSA signatures |
| Agent Control Standard Instrument Specification v0.1 (ACS) | Framework specification, version 0.1 | A worked example of a normative chain formula and a chain-head publication requirement; binding only on implementations of that specification |
| AI Forensics Audit Trail Specification v1.0 | Draft reference specification, published 2026-05-15 | An additional design reference for offline verification with an audit envelope and public JWKS |
| OWASP APTS Auditability Implementation Guide | Implementation guidance; a publication date is not stated in the reviewed source | Independent audit infrastructure, separate audit-write credentials, and handling of sensitive evidence |
The IETF Datatracker’s status notice for draft-sharif-agent-audit-trail-06 states: “This document is an Internet-Draft (I-D). Anyone may submit an I-D to the IETF. This I-D is not endorsed by the IETF and has no formal standing in the IETF standards process.” Use the draft as a proposal, not an approved standard.
None of the specifications above publishes runtime overhead, throughput, or detection-rate figures. Measure append latency and storage growth in your own environment before choosing how often to publish checkpoints.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
