Evidence, not logs: what an auditor can actually verify

Every agent platform says it has an audit log. Most of them do. The question an auditor asks is a different one: can I verify this without trusting you? For a log, the answer is no. For a trace, the answer is still no. This post is about what it takes for the answer to be yes, and what one record looks like when it is.

A log is a file the operator controls

A log is text appended to a file or a table. The operator owns the disk, the database and the credentials to both. A log line can be edited, dropped or inserted after the fact by anyone with write access, and write access is held by the people who run the system. That is not an accusation. It is a description of where the file lives.

Append-only storage helps a little. Write-once buckets, signed log segments, retention locks. They raise the cost of a quiet edit. They do not remove the single party who can pay it. If the operator holds the signing key and the bucket, the operator can rebuild the log and sign it again.

Auditors know this. It is why "show me the log" is followed by "show me who can write to it", and why the second question usually ends the conversation.

A trace adds structure, not independence

Tracing is better engineering than logging. A trace has spans, parents, timings and attributes. You can follow one request through six services and see where it waited. For debugging it is the right tool.

But a trace is still produced by the system being traced and stored by the people who run it. It has the same owner as the log. Structure makes it easier to read. It does not make it harder to change. A span that says decision=refused is a string in a database, and the database has an administrator.

Evidence is a record more than one party confirmed

Evidence is different in one specific way. Before the record is written, more than one party checks it and agrees to it. Each party keeps its own copy. After that, changing the record means changing every copy, held by parties who do not share an administrator.

That changes what an auditor can do. Instead of asking the operator to export a log, the auditor takes the operator's record and compares it to a copy held by someone else. If the copies match, the record stands. If they do not, something was changed, and the auditor knows which side changed it. At no point did the auditor have to trust the operator's database, or ours.

Regulators and auditors increasingly ask for logs that cannot be quietly edited. A record confirmed by independent parties before it is written is the plain way to meet that ask. Everything else is a promise about who has the keys.

Walk one refusal through

Here is what this looks like for one step. An agent working a job asks to do something. The step is checked against the agent's badge for that job. The badge does not allow it. The step is refused, and the refusal is written down.

The step. A pricing agent, three hops into a job, asks to send a draft outside the organisation.

The rule it broke. The badge for this job was narrowed at each hop. At the third hop it allows the agent to read one file and write one quote. Sending anything outside was never in it. Not removed. Never granted.

Who confirmed the record. The door that refused the step proposes the record. The party on the other side of the exchange checks it against its own view of the badge and confirms. Only then is the record written, and both hold it.

How an auditor replays it. The auditor takes the record, takes the badge as it stood at that hop, and asks: given this badge, was this step allowed? The answer is a computation, not an opinion. Then the auditor compares the record to the other party's copy. Both must agree.

The redacted record looks like this.

1{2  "time": "2026-10-14T09:14:06Z",3  "session": "<session id>",4  "agent": "pricing",5  "action": "send-external",6  "decision": "refused",7  "reason": "outside badge",8  "badge": { "hop": 3, "allows": ["read:quote-file", "write:quote"] },9  "confirmedBy": ["requesting-party", "serving-party"]10}

Nothing in it asks you to take our word. The decision follows from the badge and the action. The confirmation names two parties, not one. Anyone holding a copy can check both.

What we are building so the auditor does not need us

Two things, both planned, neither shipped yet.

The first is a replay pack: for one job, a bundle of the records, the badges as they stood at each hop, and the confirmations. Self-contained, exportable, small. An auditor receives it and does not need access to our systems to read it.

The second is an open-source verifier. A small program that takes a replay pack and does two jobs: recompute every decision from the badge and the step, and check every confirmation. It prints match or mismatch, per record. Open source matters here. A verifier only we can read is another promise.

Until those ship, the honest claim is narrower. The record is confirmed by more than one party before it is written, and we will show you how to check it against the other party's copy under NDA. We are not claiming more than that today.

What to take with you

• A log is owned by the operator. Structure (a trace) does not change who owns it.
• Evidence is a record more than one party confirmed before it was written, with each party holding a copy.
• An auditor verifies evidence by recomputing the decision and comparing copies, not by trusting an export.
• A refusal is the most useful record to keep: the step, the rule, the confirmation, and nothing else.
• Replay pack and open-source verifier: we are building them. Ask before you take our word for it.

If you review agent systems for a living, tell us what the pack should contain. The trust page has the contact.