Why Your Audit Store Cannot Be Inside the Process
Why Your Audit Store Cannot Be Inside the Process
If an AI agent can modify its own audit log, that log is worthless. This sounds obvious, but most agent frameworks store their history in the same process memory or filesystem that the agent controls. The agent could - intentionally or through a bug - alter its own records.
Git as an External Audit Store
Git solves this elegantly. Every commit is content-addressed with SHA hashes. The history is append-only by default. And critically, you can push to a remote that the agent has write access to but not force-push access. The agent can add commits but cannot rewrite history.
Why Append-Only Matters
When an agent makes a mistake, you need to know exactly what it did and when. If the agent can delete or modify log entries, you lose that ability. Append-only storage means every action is recorded permanently, even if the agent later tries to clean up after itself.
The Separation Principle
The core rule is simple - the thing being audited must not control the audit store. This means:
- Agent actions get committed to git, not written to a local log file the agent can edit
- Git push goes to a remote where force-push is disabled
- The agent's working directory is separate from the audit repository
- Audit entries include timestamps, inputs, outputs, and the agent's reasoning
Practical Implementation
Set up a bare git repo as your audit store. Give the agent a deploy key with push-only access (no force push). After every significant action, the agent commits a structured log entry. On the remote, enable branch protection rules that prevent history rewriting.
This gives you a tamper-evident record of everything the agent did. If something goes wrong at 3am, you can trace exactly what happened, what the agent was thinking, and what inputs led to the problem.
The overhead is minimal. Git commits are fast, and the audit repo stays small since you are only logging metadata and decisions, not full file contents.
Fazm is an open source macOS AI agent. Open source on GitHub.