AI Agent Audit Trail: Hash-Chained Log Demo
1. Record simulated agent steps
Everything stays in this page. Use made-up data only.
2. The chain and the verifier
No entries yet. Append a step or load the sample run.
Try this: tamper with an entry and see the break appear at exactly that entry. Reset, then use “rebuild all hashes”: the chain verifies again, because the attacker recomputed everything. Anchor the head first and the same rewrite is caught. Delete the last entries by importing a shortened chain and only an anchor notices.
3. Export the chain, verify an imported one
4. What an agent audit record must contain
Tick what your real agent platform records today. Coverage is the share of these ten items; each counts the same. It is a PlayCISO checklist, not a standard.
TL;DRAt a glance
5 points
- Each entry's hash covers its content and the previous hash, so editing, removing or reordering an earlier entry breaks the chain at a findable point.
- Hashing uses WebCrypto SHA-256 in your browser. Nothing is uploaded and the demo uses made-up data.
- A chain proves tampering only against an anchor held where the writer cannot rewrite it. An attacker who rebuilds every hash passes the chain check on its own.
- It does not prove completeness, and the agent or its logging code can lie about what it recorded.
- A ten-item checklist scores what your real audit record captures. It is a PlayCISO checklist, not a standard. Markdown and PDF export is a paid feature; copying and downloading the JSON chain is open.
What a hash chain gives you, and what it does not
It gives you: tamper evidence for anyone who holds the chain plus a trusted copy of one later hash. Edit entry N and its stored hash stops matching; remove or reorder entries and the links and positions stop matching.
It does not give you:
- Completeness. If the agent never wrote a step, or the logging code skipped it, no chain reveals the gap. Truncating the tail is invisible without an anchor.
- Honest inputs. The writer hashes whatever it is given. A compromised agent or logging wrapper can record a prompt that was not the prompt sent.
- Protection from a full rewrite. Anyone who can write the chain can recompute every hash after an edit. Try it above: the chain verifies until an anchor is set.
Closing the gap
Anchor the head hash outside the writer’s reach and do it often: write-once storage, a separate system the agent platform cannot modify, or a signed timestamp from a Time Stamping Authority as described in RFC 3161. Public append-only logs built on Merkle trees, as in Certificate Transparency (RFC 9162), go further by letting independent parties check that a log only ever grew. Our demo uses a simple linear chain, not a Merkle tree, and the anchor button only simulates publishing the hash.
Log from a component the agent cannot reach, such as the tool gateway or the identity provider, in addition to what the agent reports about itself. The OWASP Logging Cheat Sheet says stored logs must be protected from tampering, unauthorised access and deletion, and that some data (tokens, passwords, card data, some PII) should not be logged directly: log hashes or references for those, not the secret itself.
NIST SP 800-53 groups audit requirements in its Audit and Accountability family and NIST SP 800-92 covers log management in general. Both predate AI agents, and we read only their publication pages, so treat them as background rather than as a mapping of agent controls.
Frequently asked questions
What is a hash-chained audit log?
Each entry stores a hash of its own content plus the hash of the entry before it. Change an earlier entry and its hash no longer matches, so a verifier can point to the entry where the chain stops adding up. It makes tampering detectable; it does not stop it.
Does a hash chain prove an agent log is trustworthy?
No. It shows that a chain you hold has not been edited since the head hash was recorded somewhere the attacker cannot rewrite. It does not show the log is complete, and whatever writes the entries can still record false inputs, so the log is only as honest as the writer.
What happens if the attacker rebuilds every hash?
The chain then verifies, because nothing in it ties it to the original. The defence is an anchor: publish or timestamp the head hash outside the writer's control, so a rewritten chain no longer matches. The page demonstrates both cases.
How do you anchor a chain?
Common options are write-once storage, sending the head hash to a separate system the agent platform cannot modify, or asking a Time Stamping Authority to sign it (RFC 3161). Public append-only logs built on Merkle trees, such as Certificate Transparency (RFC 9162), let outsiders audit consistency. This demo uses a simple linear chain and a button that stands in for anchoring.
What should an AI agent audit record contain?
At least the exact prompt, the retrieved chunk ids and hashes, each tool call with name, arguments and result, the initiating principal and the agent identity, the policy decision, the state change, trusted timestamps and the model version. The checklist on this page lists ten items and scores your coverage. It is our checklist, not a standard.
Which standards talk about audit logging?
NIST SP 800-92 is a general guide to log management, NIST SP 800-53 has an Audit and Accountability control family, and the OWASP Logging Cheat Sheet says logs must be protected from tampering, unauthorised access and deletion. None of them was written for AI agents; we use them as background.
Is anything uploaded?
No. Hashing uses your browser's built-in WebCrypto SHA-256, the chain lives in the page and is gone when you close it. Use made-up data only.
Sources
Pages below were fetched on 4 November 2026. We restate them in our own words.
- SP 800-92, Guide to Computer Security Log Management — NIST, September 2006. Accessed 4 November 2026.Old (2006) and written before AI agents; used here only for the general practice of log generation, storage and protection.
- SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations — NIST, September 2020 (updates as of 10 December 2020; release 5.2.0 noted 27 August 2025). Accessed 4 November 2026.We read the publication page, not the control text. We refer to the Audit and Accountability (AU) family by name only.
- Logging Cheat Sheet — OWASP Cheat Sheet Series, as served 4 November 2026. Accessed 4 November 2026.Says logging mechanisms and stored events must be protected from tampering, unauthorised access and deletion, and lists data that should not be logged directly (tokens, passwords, card data, some PII).
- RFC 9162: Certificate Transparency Version 2.0 — IETF (Experimental), December 2021. Accessed 4 November 2026.Background on public append-only logs that anyone can audit, built on Merkle trees. Our demo is a simple linear hash chain, not a Merkle tree and not Certificate Transparency.
- RFC 3161: Internet X.509 PKI Time-Stamp Protocol (TSP) — IETF (Standards Track), August 2001. Accessed 4 November 2026.Background on asking a Time Stamping Authority to sign a hash, one way to anchor a chain head outside the writer.
We tried to read Replit’s “Agent Habitat Architecture” post on 4 November 2026 and the page returned an error, so nothing here relies on it. Replit sells a managed agent product; treat any vendor framework as a vendor’s view, not a standard.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.