What a hash-chained audit log actually proves
When an agent acts with your credentials, the question after an incident is not only was this allowed? It is can anyone quietly rewrite the story afterwards? "Cryptographic audit trail" gets waved around a lot. Here is what it buys you, precisely.
Each entry vouches for the one before
Every decision — allows, approvals and refusals — is appended to a log. Each entry carries a hash of its own content and the hash of the previous entry. That second field is the chain: entry n is committed to n−1, which is committed to n−2, back to the first record.
Verifying is a walk: recompute every hash, check every link, confirm no sequence number is skipped. Nothing more exotic than that.
One quiet edit becomes a loud one
Say someone rewrites an old refusal so it reads as allowed. Its content no longer matches its hash, and verification points straight at it. Say they also recompute that hash. Now the next entry's link no longer matches, and verification points there instead.
To hide one edit, every later entry must be rewritten too. The chain turns "change one line" into "forge the whole history from that point on".
Tamper-evident, not tamper-proof
Nothing here prevents tampering. Whoever controls the whole file can delete it or regenerate it end to end with valid hashes. The guarantee is narrower: an edit inside a log you keep cannot be both selective and silent.
A full regeneration is only visible if an earlier copy disagrees with it — a mirrored sink, a backup, a head hash recorded on a machine the agent's host cannot reach.
Log the refusals too
A trail that only records what happened is half a trail. The attempts that were stopped are often the interesting part: a burst of denied payment calls says something a clean list of allowed ones never will. Drift in an agent's behavior shows up there first.
One more property worth asking for: the format should be specified well enough that an independent tool can verify the log. A log you can only check with the program that wrote it asks for the very trust it was built to remove.
Check your own agent's log against three questions: does it record refusals, is its latest hash stored somewhere the agent cannot write, and can something other than the writer verify it? If any answer is no, start there.