What makes an audit trail tamper-proof?
The core requirement is that no one—not even an insider—can silently alter, reorder, or delete log entries. The strongest evidence comes from a clinical AI system that used hash chains and Merkle trees to bind every event, achieving 100% detection of unauthorized modifications with a median verification time of 3.2 ms per event [1]. This means any tampering attempt is caught almost instantly, and the system can ingest over 10,000 events per second without slowing down clinical workflows [1].
A blockchain-based approach offers a different route to the same goal: BlockTrail fragments a blockchain into layers to reduce storage overhead while maintaining security, and a separate blockchain-anchored model for inter-operator settlement achieved 100% audit trail integrity while cutting settlement time from 120 days to 3 minutes [5][6]. The takeaway: whether you use a private hash chain or a public blockchain, the key is that the log is append-only and cryptographically verifiable by anyone with the right keys.
How do you prove a human actually authorized the action?
In multi-agent systems, a terminal action might be several hops away from the original human instruction. The Human Delegation Provenance (HDP) protocol solves this by binding a human authorization event to a session, then recording each agent's delegation as a signed hop in an append-only chain [3]. This lets any participant verify the full chain of delegation offline, using only the issuer's public key and session ID—no third-party trust anchor needed [3].
Similarly, Agentic JWT (A-JWT) binds each agent's action to verifiable user intent and a specific workflow step, using a one-way checksum of the agent's prompt, tools, and configuration to prevent impersonation [2]. Both protocols address a gap that standard OAuth 2.0 and JWT don't cover: multi-hop, append-only, human-provenance requirements [3]. In practice, this means you can prove not just that an action happened, but that it was explicitly authorized by a human and not the result of a prompt injection or scope creep.
What's the gap between best-case and typical-case evidence?
The papers here show what's possible in controlled settings, but real-world adoption is uneven. For instance, the clinical AI system achieved near-perfect tamper detection in experiments across diverse hospital sites and vendors [1], and the blockchain settlement model reports 87% reduction in transaction fees and 92% less manual intervention [6]. However, these are proof-of-concept or simulation results, not large-scale production deployments.
The ESAA-Security architecture for AI-generated code audits is another example: it structures auditing as a governed pipeline with 26 tasks and 95 checks, but it's a framework proposal, not a deployed system [4]. The gap is that while the technology is proven in lab settings, the typical enterprise may still rely on basic logging without cryptographic chaining. The evidence suggests that adopting these techniques is feasible—storage overhead is under 5% [1]—but requires deliberate engineering and a shift from 'trust but verify' to 'verify by default'.
About These Sources
This answer is built on 6 studies (2 peer-reviewed, 4 preprints) — published from 2021 to 2026, 4 from 2024 or later, 1 in Q1 journals — selected as the most relevant from 6 studies that passed quality screening, drawn from 49 papers retrieved from a database of over 500 million.
Sources used in this answer
Trust, but Verify: Audit-ready logging for clinical AI
In a clinical AI system, tamper-evident logging using hash chains and Merkle trees detected 100% of unauthorized log modifications with a median verification time of 3.2 ms per event, and storage overhead was under 5% of total data size.
Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents
Agentic JWT (A-JWT) binds each agent's action to verifiable user intent and workflow step, using per-agent proof-of-possession keys to block scope-violating requests, replay, impersonation, and prompt-injection with sub-millisecond overhead.
HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
The Human Delegation Provenance (HDP) protocol cryptographically captures human authorization context in multi-agent systems, recording each delegation as a signed hop in an append-only chain, verifiable offline with only the issuer's public key and session ID.
ESAA-Security: An Event-Sourced, Verifiable Architecture for Agent-Assisted Security Audits of AI-Generated Code
ESAA-Security structures agent-assisted security auditing as a governed pipeline with 26 tasks, 16 security domains, and 95 checks, using append-only events and replay-based verification to ensure traceability and reproducibility.
BlockTrail: A Service for Secure and Transparent Blockchain-Driven Audit Trails
BlockTrail, a blockchain-based audit trail service, fragments legacy blockchain systems into layers to reduce space-time complexity and increase throughput, while maintaining security and transparency.
Blockchain-Anchored Audit Trail Model for Transparent Inter-Operator Settlement
A blockchain-anchored audit trail model for inter-operator settlement achieved 100% audit trail integrity, reduced settlement cycles from 120 days to 3 minutes, and cut transaction fees by 87%.