← Back to concept explainers

Concept Fable

tamper-evident log

Conclusion first:A Tamper-Evident Log is a logging mechanism that leaves detectable traces when entries are modified, deleted, inserted or reordered. It does not mean it is absolutely impossible to attack, but it makes tampering hard to hide, and is often implemented through append-only writes, hash chains, signatures, timestamps, WORM storage or external anchoring. If an enterprise Agent's approvals, tool calls, data access and security event records can be rewritten after the fact, their audit value drops sharply. Tamper-evident logs support investigations, compliance proof and accountability tracking.

Tamper-Evident Log · Auditability/Security

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

Account pages sealed with red wax leave a trace of the change itself

The salt warehouse moved several hundred sacks of salt in and out every day. The old warehouse clerk wrote the quantities in the ledger and locked it in a cabinet at night. For many years, everyone believed that locking the cabinet meant it was safe.

After the price of salt rose, the account books began to show a strange neatness: missing pages had no tear marks, altered numbers looked as if they had always been there, and inventory discrepancies could always be smoothed over by new totals.

The warehouse owner first replaced the cabinet lock with a heavier one, then ruled that only two people could touch the ledger. But as long as the person who could open the cabinet wanted to change it, the pages could still quietly become a different history.

During an official investigation into a shortage, all the warehouse clerks said the account books were true. The official asked: If someone had altered them, how would you know? The warehouse owner could not answer.

The new scribe changed the ledger into chain-linked pages. Each page, once written, was sealed with red wax; on the red wax was pressed the mark of the previous page and the day's secret sign; each new page had to catch the pattern left by the old page.

From then on the ledger could still be peeked at, and someone might try to rewrite it, but deleting a page, inserting a page, or changing a number would break the pattern that followed. One night the inventory count was adjusted downward; the clerk might not know the next day who did it, but at a glance could see after which page the thread was broken.

The warehouse keeper later asked whether red wax could prevent salt theft. The clerk said no, it could only make tampering with the accounts impossible to do quietly. To prevent theft, you still needed locks, inventory counts, and guards.

This sentence let the warehouse owner distinguish two kinds of protection. The door lock reduced opportunities to approach the ledger, while the chain of pages exposed the fact that the ledger had been tampered with. The salt warehouse needed to know whether things were safe, and also needed to know whether history had been quietly rewritten. Later, when beginners started, the old master no longer began with abstract names, but had them review that mistake: where they had originally relied on intuition, why the first repair was not enough, and how the new arrangement kept risk in a place that could be checked. Only when they could explain these details clearly, and also point out when to keep using the method and when to upgrade it, were they considered to truly understand this approach. Later they also handed this approach to newcomers for drills: first have newcomers do it the old way and see how errors appeared; then redo it under the new rules and see which step was blocked in advance and which step left evidence. If newcomers only memorized names, they would still misuse it in similar scenarios; only those who could state the applicable boundaries, costs and remedies after failure were allowed to take on work independently.

Reveal

This story is about: immutable logs

A Tamper-Evident Log is a logging mechanism that leaves detectable traces when entries are modified, deleted, inserted or reordered. It does not mean it is absolutely impossible to attack, but it makes tampering hard to hide, and is often implemented through append-only writes, hash chains, signatures, timestamps, WORM storage or external anchoring. If an enterprise Agent's approvals, tool calls, data access and security event records can be rewritten after the fact, their audit value drops sharply. Tamper-evident logs support investigations, compliance proof and accountability tracking.

What matters is that it is not just a term, but a structural problem that repeatedly appears in real AI / Agent systems. Understanding it lets you judge when to add a model, when to change a process, and when to add governance.

Metaphor mapping

  • Salt warehouse ledger: system logs and audit records
  • A heavier cabinet lock: protection that relies only on access control
  • Chain pages and red wax: hash chains, signatures, or append-only logs
  • The pattern is broken: tampering can be detected
  • Not knowing who did it but knowing it was changed: the core boundary of tamper-evident
  • The salt warehouse needs both: access control and tamper-proof records are complementary
  • Inventory shortfall: a security incident or compliance dispute

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

immutable logaudit trailevidence integritychain of custody

Related distinctions

This concept is easily confused with adjacent concepts; it is recommended to continue to the comparison page.

京ICP备2026014272号