5K

Cryptographic Governance Audit Trail

Middleware checks each tool call against a policy file, then signs a receipt of the action with ML-DSA and appends it to a tamper-evident chain

emerging Updated 2026-07-23 By jagmarques (@jagmarques) Based on SCITT (Supply Chain Integrity, Transparency and Trust), OWASP Agentic Top 10
View .md Edit on GitHub
Add to Pack
or

Saved locally in this browser for now.

Cite This Pattern
APA 
jagmarques (@jagmarques) (2026). Cryptographic Governance Audit Trail. In *Awesome Agentic Patterns*. Retrieved September 28, 2026, from https://agentic-patterns.com/patterns/cryptographic-governance-audit-trail
BibTeX 
@misc{agentic_patterns_cryptographic-governance-audit-trail,
  title = {Cryptographic Governance Audit Trail},
  author = {jagmarques (@jagmarques)},
  year = {2026},
  howpublished = {\url{https://agentic-patterns.com/patterns/cryptographic-governance-audit-trail}},
  note = {Awesome Agentic Patterns}
}

Use when

  • Regulated environment such as finance, healthcare, or EU AI Act
  • You must prove what an agent did and whether it stayed within policy
  • Agent framework supports tool-calling middleware

Avoid when

  • Per-call signing latency is not acceptable
  • You cannot manage signing keys or store receipts that grow with activity

Problem

When AI agents execute tool calls autonomously, there is no tamper-evident record of what happened. Traditional logging is mutable - logs can be altered after the fact. In regulated environments (finance, healthcare, EU AI Act), teams need to prove exactly what an agent did, when, and whether it operated within policy. Without cryptographic guarantees, audit trails have no legal or compliance weight.

Solution

Sign every agent action with a post-quantum digital signature (ML-DSA) at the point of execution. Each tool call produces a signed receipt containing the action, parameters, result hash, timestamp, and policy evaluation outcome. These receipts form an append-only chain that is tamper-evident by construction.

The governance layer operates as middleware that wraps the agent tool-calling interface:

  1. Pre-execution: Check the tool call against a policy file (allowed tools, rate limits, data access rules)
  2. Execution: Run the tool call normally
  3. Post-execution: Sign the action receipt with ML-DSA and append to the audit trail

Evidence

  • Evidence Grade: medium
  • Most Valuable Findings:
    • SCITT architecture (IETF RFC 9334) validates the append-only signed receipt pattern for supply chain integrity
    • OWASP Agentic Top 10 lists lack of audit trail as a top vulnerability for agent systems
  • Unverified / Unclear: Long-term storage and verification overhead at scale needs more production data

How to use it

  • Apply to any agent framework that supports tool-calling middleware (LangChain, CrewAI, MCP, etc.)
  • Define policies in YAML specifying which tools are allowed, rate limits, and data access rules
  • Store signed receipts locally or export to a compliance system
  • Use for EU AI Act Article 12 (record-keeping) and SOC2 audit evidence

Trade-offs

  • Pros: Tamper-evident audit trail, policy enforcement before execution, quantum-safe signatures, framework-agnostic
  • Cons: Adds latency to each tool call (signing overhead), requires key management, receipt storage grows linearly with agent activity

References