Append-only record: what it means for AI agents

An append-only record is a log to which entries can be added but never changed or removed. A correction is written as a new entry that refers to the one it corrects, so the original stays visible. In a governed agentic operating system, every verdict on every agent action is filed this way, so any decision can be reconstructed later.

Why does an append-only record matter for AI agents?

An agent can take thousands of actions a day. When one goes wrong, someone will ask what the agent saw, what it proposed, which bound decided and who approved it. If the record of those facts can be edited, the answer is only as good as the trust you place in whoever had edit rights. An append-only record removes that question.

It also changes what can be counted. Because refusals and holds are filed alongside completed actions, the record shows what an agent tried and was stopped from doing, not only what it did. That is often the more telling figure, as argued in count what an agent refuses, not only what it completes. The reasons for the design are set out in why the agent record must be append-only.

How does it work in practice?

Each entry typically holds:

• the agent, the capability and the depth it held at that moment;
• the proposed action and its inputs, with the provenance of each fact;
• the verdict: allowed, held, refused or withheld;
• the deciding bound that determined the verdict;
• for held actions, the named person who decided and when;
• a reference to the previous entry, so gaps or changes are detectable.

The last point is what makes the record tamper-evident rather than merely append-only by policy. Each entry carries a fingerprint of the one before it; altering an old entry breaks the chain from that point forward. Methods are discussed in how do you make an AI agent's record tamper-evident?

What does that look like in an example?

A lender's servicing agent drafts a payment holiday for a borrower. The customer ceiling keeps payment holidays at depth 2, so the verdict is held. A team leader approves it. A week later, the team finds the borrower was not eligible. Nobody edits the original entries. A new entry records the reversal, who made it and why, pointing to the approval it corrects. An auditor looking at the case sees the full sequence: draft, approval, discovery, reversal.

How is an append-only record different from an audit log?

Many audit logs are append-only in practice but not by design. Administrators can rotate, truncate or edit them; retention rules delete old entries; application errors overwrite lines. An append-only record makes immutability a property of the store, enforced by the system, and makes any break detectable.

There is also a difference in content. A typical audit log records events: a user logged in, a field changed. An agent's append-only record records decisions: what was proposed, against which bounds, with what verdict, and why. One tells you something happened; the other tells you whether it should have. The wider governance approach is in agent governance is a bound, not a model.

Where Pryme fits

In Pryme, every verdict, including refusals and withheld actions, is filed in an append-only record with the deciding bound named. Corrections are new entries. The record can be exported for an investigation or an audit without anyone needing to vouch for it, because its integrity can be checked directly.