What a tamper-evident decision log actually is
A record that can be quietly edited is not evidence. It is a note. The difference only matters once somebody asks why an agent sent what it sent.
What does a hash chain give you?
Every entry carries the hash of the previous entry. Changing anything in the middle changes that entry's hash and breaks every entry after it. You cannot walk back one decision without invalidating the rest.
This does not make the record impossible to change. It makes a change visible, which is a different and achievable property.
The goal is not a record nobody can change. The goal is a record nobody can change quietly.
Why is a plain table not enough?
Because anyone with admin access can run an UPDATE. This assumes no bad faith; it assumes you cannot prove its absence. An audit that rests on trusting whoever holds the database credentials is not an audit.
The second issue is ordering. A table with a timestamp column lets you write an earlier date. A chain forces the order, because each entry points at one specific predecessor.
What belongs in a single entry?
Enough to reconstruct the decision without asking anyone to remember it.
- The action and its inputs.
- The policy rule that classified it, and the tier that followed.
- Who approved: the machine, or a named person.
- The evidence: test results, verification, the content prepared for sending.
- The hash of the previous entry.
What does it not solve?
It does not protect against an untruth written at the start. If the system records the wrong basis for a decision, the chain preserves that error faithfully. Tamper evidence covers the history, not the truth of a single entry.
It is also not legal proof and not a certification of any kind. It is operational tooling: it lets you answer who allowed this in a way nobody has to take on trust.
Sources
- Article 12: Record-keepingEU Artificial Intelligence Act, accessed 2026-09-09