Track AI agent actions with tamper-evident, hash-chained audit logs for EU AI Act compliance
Agent Audit Trail provides append-only NDJSON logging with sha256 chain integrity to record every tool call, decision, and external write—designed specifically for high-risk AI systems needing automatic event recording under EU AI Act Arti...
- LinkLoot access
- Free
- Provider costs
- Unknown
What you get from it
Agent Audit Trail provides append-only NDJSON logging with sha256 chain integrity to record every tool call, decision, and external write—designed specifically for high-risk AI systems needing automatic event recording under EU AI Act Article 12.
What it does
Agent Audit Trail creates an append-only, hash-chained log that records significant AI agent actions including tool calls, decisions, external writes, credential access, and payment events. Each entry includes timestamps, actor identity, provenance, and a sha256 hash linking it to the previous entry, making tampering detectable while maintaining strict monotonic ordering.
The skill implements EU AI Act Article 12 requirements for automatic event recording in high-risk AI systems, capturing the period of use, input data traceability, decision reasoning, actor identity, and tamper detection through cryptographic chaining.
Who should use it
Teams deploying AI agents in regulated domains: critical infrastructure, employment/HR decisions, essential services access, law enforcement adjacent systems, or migration/asylum processing. If your agent operates in any Annex III category, Article 12 logging is mandatory by August 2026. Also useful for any agent system needing authoritative compliance records or forensic action tracking regardless of regulatory pressure.
Setup surface
Create audit/atlas-actions.ndjson as your log file. Wire configuration into workspace TOOLS.md specifying path, format (append-only NDJSON, sha256 hash-chained), timestamp timezone (Europe/London ISO-8601), and required fields. Add audit invariants to SOUL.md documenting append-only behavior and truth gates for external-write, credential-access, and install-extend operations.
An optional Python helper script (scripts/audit_append.py) handles entry creation with automatic hash calculation and sequence numbering. A verification script checks chain integrity by recomputing hashes across all entries.
Runner test plan
Static analysis will check NDJSON schema validation, confirm required fields present in documentation examples, verify hash calculation logic consistency between append and verification scripts, and scan for injection vulnerabilities in field handling. Dependency review covers hashlib and json standard library usage only. Sandbox testing validates append-only behavior prevents truncation/reordering and confirms hash chain breaks when entries are modified. Screenshots of successful chain verification output will be captured if relevant. Residual risks include manual wiring errors in TOOLS.md/SOUL.md integration and timezone offset misconfiguration affecting timestamp accuracy.
Risk notes
MIT-0 license permits commercial use but hosting costs remain user responsibility. Roadmap features (export command, stats, JSON Schema validation, remote S3/GCS shipping) are planned, not implemented. Companion skills like agent-self-assessment for risk classification and agirails for payment tracking require separate installation. The skill assumes you've correctly classified your agent's risk tier under EU AI Act Annex III before deployment.
Source links
Original skill documentation Skill listing Awesome OpenClaw Skills ClawHub registry
Discussion
Share practical experience, questions, or warnings with the community.
Sign in to join the discussion and vote on comments.
Sign in