Advanced: Agent Dev 18 Keeps a Tamper-Proof Ledger of Agent Actions

Ordinary logs can be changed by anyone. Open a signed receipt for each tool call, then chain the receipts together, and you can later check whether anything has been altered.

Remember These Points First

• The problem: an auditor asks, "How do you prove the log was never changed?" Ordinary logs, cloud logs, and database logs all require trusting someone.
• Receipt: a JSON record of what the Agent did, signed with a private key so anyone can verify it offline with the public key.
• Canonical encoding: ensures identical content produces identical bytes, so signatures are stable.
• Hash chain: each receipt carries the hash of the previous one, so deleting or reordering receipts breaks the chain.
• Three guarantees: this key signed it, the content has not changed, and its order within this chain.

Going Deeper

What it proves and what it doesn't. It proves that this record was signed by this key, that its content has not been altered, and that its order has not been scrambled. It does not prove who the key's owner is (that requires a separate, trusted binding). Nor can the chain alone detect that the tail was truncated, or that the signer rewrote history themselves. That requires an externally anchored chain head, independently witnessed checkpoints, or an authenticated integrity commitment.

How to make a receipt. Extract the key information of the call: who, when, which tool was called, a summary of the parameters, a summary of the result, and the hash of the previous receipt. Canonicalize it using a consistent rule, sign it, and store it together. To verify, offline recompute the hash, check the signature, and check the chain.

Where it's used. Regulated industries (finance, healthcare) and scenarios requiring third-party audits. For small internal teams, standardizing ordinary logs first is often sufficient.

Try It Yourself

Design a field list for a receipt: include at least the time, the action, a parameter summary, a result summary, and the hash of the previous receipt, and think about whether to include sensitive content.

Let Your Agent Teach You

Give the following to your Agent (Claude Code, ChatGPT, and Gemini all work), and it will guide you step by step like a mentor.

References

• Content adapted from Lesson 18 (18-securing-ai-agents) of microsoft/ai-agents-for-beginners, originally licensed under MIT.
• For the original version and complete code: 18-securing-ai-agents
• For all courses, see the Agent Course Roadmap