agent-audit-trail

---
name: Agent Audit Trail
version: 2.1.0
description: >
  Append-only, hash-chained audit log for AI agents. Records agent actions,
  tool calls, decisions, and external writes with provenance, timestamps, and
  sha256 chain integrity. Designed for compliance with EU AI Act Article 12
  automatic event recording requirements for high-risk AI systems.
author:
  name: Justin Roosch
  url: https://github.com/roosch269
license: MIT-0
tags:
  - audit
  - compliance
  - logging
  - eu-ai-act
  - article-12
  - governance
  - provenance
  - security
keywords:
  - audit trail
  - agent logging
  - hash chain
  - event log
  - compliance logging
---

# Agent Audit Trail

An append-only, hash-chained audit log for AI agents. Every significant action, decision, tool call, and external write is recorded with a sha256 chain linking entries together — making tampering detectable and providing an authoritative compliance record.

## Overview

This skill provides:
- **Append-only NDJSON log** at `audit/atlas-actions.ndjson`
- **Hash-chained entries** — each entry includes the sha256 of the previous entry
- **Monotonic ordering** — `ord` field ensures strict sequence
- **Structured fields** — consistent schema across all event types
- **EU AI Act Article 12** compliance implementation

## Log Location

```
audit/atlas-actions.ndjson
```

The file is append-only. Never truncate, overwrite, or reorder entries.

## Log Entry Schema

Each line is a valid JSON object:

```json
{
  "ts":         "2026-04-02T18:00:00.000+01:00",
  "kind":       "tool-call",
  "actor":      "atlas",
  "domain":     "agirails",
  "plane":      "action",
  "gate":       "external-write",
  "ord":        42,
  "provenance": "session:agent:main:discord:channel:1472016988741177520",
  "target":     "audit/atlas-actions.ndjson",
  "summary":    "Appended audit log entry",
  "prev_hash":  "sha256:abc123...",
  "hash":       "sha256:def456..."
}
```

### Field Reference

| Field | Type | Description |
|-------|--