When an autonomous agent finishes a task, we ask it what it did. It answers, and it writes that answer to a log. Then, later, when something goes wrong, we open the log to find out what happened. The problem is that the same system we are holding accountable is the one that wrote the record we are using to hold it accountable.
A log like that is a statement of intent, not a piece of evidence. It tells you what the agent was willing to report, which is not the same thing as what the agent did, and is exactly the same thing an agent that wanted to hide something would produce.
The hardest tamper is the one that removes
Editing a log leaves a trace if you are looking for one. The tamper that defeats ordinary auditing is deletion: an event that simply never appears. Nothing looks wrong, because nothing is wrong on the surface: the record is internally consistent, it is just missing a line.
In Tesserae I ran this head-to-head. Across 39 real agent runs, I silently deleted one event from each and asked two systems to notice: a conventional event log, and a hash-chained one. The conventional log caught 0 of 39. The hash chain caught 39 of 39 — because every event's hash folds in the one before it, so removing a link breaks every hash downstream of the gap.
Why this is cheap enough to always do
The usual objection is cost. But sealing an event into the chain takes about 24.6µs at the median, and a single LLM call is on the order of hundreds of milliseconds. The audit layer is four orders of magnitude below the thing it is auditing. There is no runtime budget argument against it.
If you cannot prove the log was not edited, it is not evidence. It is a story the system tells about itself.
None of this makes an agent trustworthy. It makes its account checkable, which is the precondition for everything else. You cannot detect misbehaviour in a record that the misbehaving party is free to rewrite.