A record that can be edited cannot settle a dispute. If anyone with access can change what the agent's log says it did, then the log is a claim, not evidence. Append-only filing, where entries can be added but never altered or removed, is what lets a firm reconstruct any agent decision and show that the account has not been changed since.
What is the record actually for?
Most teams think of agent logs as a debugging aid. They are that, but the record that matters for governance has a different job. It is the evidence a firm produces when a customer disputes an outcome, when an auditor tests a control, when a regulator asks how a decision was made, or when an incident review needs to know exactly what happened in what order.
In each of those situations, the person reading the record is not on your side by default. A customer who says they never authorised a payment, or an auditor testing whether a limit was applied, needs to be able to rely on the record without trusting the team that keeps it. That is the test an editable log fails.
An append-only record passes it. Entries are written once. Corrections are made by adding a new entry that refers to the earlier one, never by changing it. The history of the history is preserved.
Why is an editable log not good enough?
The argument is not that people will falsify logs. Most will not. It is that once editing is possible, nobody can prove it did not happen, and that doubt is enough to undermine the record in any contested case.
There are ordinary reasons logs get changed, too. A data clean-up job trims entries it considers noise. A developer fixes a formatting problem by rewriting old rows. A retention script deletes records early. A well-meaning engineer redacts a field after the fact. Each change is innocent. Each one means the record no longer shows what was known at the time.
| Situation | With an editable log | With an append-only record |
|---|---|---|
| Customer disputes a refund decision | The firm's account can be questioned, since it could have been changed | The entry, its timestamp and its integrity check stand on their own |
| A wrong verdict is later corrected | The original is overwritten and the error disappears | The original and the correction both remain, linked |
| Auditor tests whether a limit was applied | Must trust that entries were not altered after the test period | Can verify the sequence has not been changed |
| Incident review reconstructs a task | Gaps or edits may hide the actual order of events | Every step is present in the order it was filed |
What should each entry contain?
Append-only is about how entries are kept. What they contain matters just as much, because an unalterable record of the wrong fields is still useless.
For agent decisions, each entry should let a reader rebuild the verdict without asking anyone. That means the action attempted, the agent and its certificate status at that moment, the bounds that were checked and which one decided, the verdict, the facts relied on with their provenance, and any person who approved or rejected a held action. Our piece on why provenance must travel with every fact explains why the source class of each fact belongs in the entry, not just the fact itself.
The EU AI Act's Article 12 requires high-risk AI systems to allow automatic recording of events over their lifetime. What that means in practice for an agent is set out in Article 12 logs: what an AI agent's record must capture. An append-only design makes those logs far easier to rely on.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How is append-only actually achieved?
There are several technical routes, and the right one depends on scale and existing systems. What they share is that the guarantee does not rest on good behaviour.
- Write-once storage, where the storage layer itself refuses changes to existing entries for a set period.
- Hash chaining, where each entry includes a fingerprint of the one before, so any change breaks the chain and is detectable.
- Separation of duties, so the teams that run agents cannot alter the store that records them.
- Periodic anchoring, where a summary fingerprint of the record is published or stored somewhere independent, so the whole sequence can be checked later.
Any of these, done well, means a reviewer can verify the record rather than take it on trust. Most firms combine two or more.
What about data protection and deletion?
Append-only does not mean keep everything forever. Records still need retention periods, and personal data still has to be handled lawfully. The difference is that deletion is itself a recorded, governed event: the record shows that entries were removed under a stated rule at a stated time, rather than silently disappearing.
Where personal data must be removed from an entry before its retention period ends, the usual approach is to keep personal fields separately, referenced from the record, so they can be deleted without breaking the integrity of the decision trail.
Where Pryme fits
In Pryme, every verdict is filed in an append-only record: the action, the five bounds checked, the deciding bound, the facts relied on with their provenance class, and any person who released a held action. Records can be exported for an investigation with their integrity intact; the process is covered in how to export an AI agent's verdict record. See also how an agentic operating system records decisions and the governed agentic operating system, explained.
Questions people ask
Can an append-only record ever be corrected?
Yes, by adding a new entry that refers to the one it corrects and states why. The original stays visible, so anyone reading the record sees both the error and the correction.
Is this the same as keeping backups?
No. Backups protect against loss, not against change. A backup of an edited log faithfully preserves the edits.
Does the record need to hold the full conversation?
It should hold enough to reconstruct the decision: the action, the bounds, the verdict and the facts relied on. Full transcripts can be kept separately under their own retention rules and referenced from the entry.