On-chain audit trails make AI agents accountable

Problem

Long-horizon, tool-using agents perform thousands of ordered actions whose harm often arises from sequences rather than single outputs. Existing observability tooling assumes cooperative operators and mutable logs, so it cannot provide tamper-evident, externally verifiable evidence for cross-organisational disputes or post-incident causality questions. The paper addresses the need for non-repudiable, privacy-aware audit trails that bind intent, execution and provenance while enabling independent verification when no neutral intermediary exists.

Approach

The Agent Flight Recorder records each agent action as a canonically serialized event with eight semantic fields: intent, policy evaluation, human approval, execution, effects, context provenance, code provenance and delegation provenance. Events are serialized deterministically using CBOR, then incorporated into a local append-only structure with three integrity layers: a per-event SHA-256 hash chain for ordering and truncation detection, Merkle batching of epochs for compact inclusion proofs and gap detection, and periodic on-chain anchoring of 32-byte epoch roots plus back-pointers to provide a public commitment. Payloads are stored off-chain and encrypted by default; selective disclosure uses an HKDF-based key hierarchy with per-epoch and per-event keys. The prototype is a Python implementation evaluated across five cumulative ablation configurations from plain JSON logging to the full anchored stack, using synthetic long-horizon workloads and a small set of real agent traces. Metrics include per-event latency, storage overhead, tamper-detection rates across four attack classes, anchoring cost, and forensic query precision.

Key Findings

• Low runtime and storage overhead: the full integrity stack adds about 48 microseconds median latency per event and increases stored bytes to roughly 512 bytes per event, with signing work amortised at epoch boundaries.
• Affordable anchoring at scale: measured projections show L2 anchoring costs about $2.30 per 100,000 events at 100-event epochs, making sub-minute compromise windows practical; L1 anchoring is orders of magnitude more expensive.
• Complete tamper detection under the evidence model: the full stack detected edit, delete, reorder and equivocation (fork) attacks at 100% with zero false positives in experiments; Merkle batching secures terminal events and on-chain anchors enable fork detection.
• Substantially better forensic precision: structured event fields yield perfect precision and recall on guardrail and delegation queries (precision 1.0), compared with unstructured text search precision of 0.013 and 0.077 respectively.
• Anchoring uniquely enables neutral third-party verification: on-chain epoch roots let any holder of the disclosed payload and Merkle proof verify records independently without pre-agreement on a trusted intermediary.

Limitations

The system does not guarantee completeness if actions bypass the recorder, cannot ensure truth of entries written after full host compromise, and requires off-chain availability of payloads and proofs for content recovery. Selective disclosure protects privacy only under cooperative audit because possession of an epoch key reveals all events for that epoch. Guarantees depend on chain liveness and uncompromised verifier keys; strategic anchoring delay and chain congestion widen the compromise window. Canonicalisation, key management and attestation integration remain practical challenges.

Implications

An adversary who compromises an operator cannot undetectably alter pre-anchoring history without producing mismatch evidence to any verifier holding disclosed material. On-chain anchoring removes the need to pre-agree a neutral recorder, enabling independent dispute resolution and provenance checks across organisations. Attackers may still exploit gaps caused by infrequent anchoring, loss of off-chain payload stores, or by compelling epoch-key disclosure; defenders and regulators should therefore consider anchoring frequency, robust off-chain availability and stronger privacy-preserving proofs in high-stakes deployments.