Covers: Definitions; The audit chain; Results; Design rules; Interview questions, with the follow-ups; Common mistakes; What the example does not do.
Definitions
Audit log, tamper-evident
Audit log: an append-only record of consequential events.
Tamper-evident: changes can be detected, even if they cannot be prevented.
Hash chain, HMAC, anchor
Hash chain: each record stores the hash of the previous one.
HMAC: a keyed hash; without the key you cannot recompute it.
Anchor: the latest hash and length stored somewhere the log's writers cannot change.
Severity, escalation, on-call
Severity: a rated seriousness of an incident that decides response speed and who is told.
Escalation: passing an issue to the next level of people when the first does not respond or lacks authority.
On-call: the person responsible for responding at a given time.
Circuit breaker, kill switch
Circuit breaker: an automatic halt when a threshold of bad events is reached.
Kill switch: a manual or automatic control that stops the agent or its tools immediately.
RACI
RACI: a table of who is Responsible, Accountable, Consulted and Informed for each activity.
The audit chain
Hash-chained entries with an external anchor and the fields every record needs.
Results
Tamper detected (200 entries):
Log
Modify
Delete middle
Reorder
Truncate tail
Rewrite all
Plain
no
no
no
no
no
Hash chain
yes
yes
yes
no
no
Hash chain + anchor
yes
yes
yes
yes
yes
HMAC chain
yes
yes
yes
no
yes
HMAC chain + anchor
yes
yes
yes
yes
yes
Severity examples:
Case
Level
Minor impact, 1 record, reversible
SEV4
Minor impact, 50 records, reversible
SEV3
Serious impact, 500 records, irreversible
SEV2
Critical impact, 5 people, irreversible
SEV1
Time to acknowledgement (minutes), each person reachable with probability p:
p
Escalate every 15 min: p95 / never reached
Re-page one person: never reached
0.9
23 / 0.1%
10%
0.7
39 / 2.5%
30%
0.5
480 (cap) / 12.3%
50%
Circuit breaker (limit N suspicious events in 60 s):
Limit
Harm in an attack (units)
False trips on normal traffic per 8 h
2
1
28
3
2
3
5
5
0
10
57
0
No breaker
68
0
Tamper detection matrix, escalation versus re-paging, and the breaker threshold trade-off.
A chain proves order and integrity up to the head; the anchor proves the head.
Escalation is protection against correlated unavailability, not against slow people.
A breaker threshold is a trade-off between harm and false stops, and the right value comes from measured baselines.
Severity rules encode values: irreversibility and reach drive urgency.
Design rules
Name an owner for every agent and every high-risk action (a RACI), including who can approve, who is on call and who may stop it.
Log consequential decisions in an append-only, tamper-evident store with a fixed schema; keep an anchor elsewhere; verify on a schedule.
Do not log raw secrets or unnecessary personal data; set retention (module 6).
Write severity definitions and response times in advance, with irreversibility and reach as inputs.
Use rule-based escalation triggers (value limits, domains, repeated denials) for the high-stakes cases; use model judgement for extra caution only.
Escalate through different people, with timeouts, and test the paging path.
Install a kill switch that cuts tool access, not just the chat, and require a named human to reset it.
Set breaker thresholds from baselines and review false trips.
Run incident reviews (blameless, with fixes) and feed them into evals and red-team suites (modules 8 and Level 9).
Rehearse: game days that practise the page, the kill switch and the audit query.
Interview questions, with the follow-ups
Who is accountable when an agent causes harm?
"The organisation and, inside it, a named owner. Technically I make that answerable: an audit log of who or what acted, with which arguments, who approved, which model and prompt version, and a trace id; a RACI for approvals and on-call; and escalation paths. The legal question depends on contracts and law, so I involve counsel; I treat it as outside engineering." Follow-up: "What do you log?" The nine fields in my record, with personal data redacted, in an append-only store.
How do you make an audit log trustworthy?
"Chain the entries by hash so edits, deletions and reordering are visible, keep an HMAC key or the anchor outside the log's storage, and check regularly. In my test a plain log detected none of five attacks, a hash chain missed truncation and a rewrite, and an anchored chain caught all five." Follow-up: "Is that immutable?" No: it is tamper-evident. For prevention use write-once storage and tight access control.
How do you design escalation?
"Rule-based triggers for high-stakes cases, such as value thresholds or irreversible actions, severity levels defined in advance, and paging that moves to different people after a timeout, because unavailability is correlated within a person. In my simulation re-paging one person never reached a human in 30 percent of incidents at 70 percent availability, escalating cut that to 2.5 percent." Follow-up: "How do you test it?" Game days: page the path at random times and measure time to acknowledge.
How do you stop an agent quickly?
"A circuit breaker on suspicious events plus a manual kill switch that revokes tool credentials, with a named human to reset. I choose the threshold from baselines: in my simulation limit 3 cut harm from 68 to 2 units but tripped about three times in 8 hours on normal traffic, limit 10 almost never tripped." Follow-up: "What about in-flight actions?" Make actions idempotent and reversible where possible (Level 8 module 6) and queue irreversible ones behind approval.
Common mistakes
Logging for debugging only, with no schema, owner or retention.
Logs that the agent can write to or delete.
A hash chain with no anchor, assumed to be immutable.
No severity definitions until the incident.
One on-call person and repeated pages.
Escalation judged by the model alone.
Kill switch that stops the chat but not the tools.
A breaker threshold chosen without baseline traffic.
No owner for approvals or incident response.
What the example does not do
In-memory log, one writer, no concurrency, no rotation, no storage guarantees.
The anchor is a Python tuple; a real anchor needs a separate trusted system.
Simulated people and attacks: availability, rates and flagged fractions are assumptions; real paging has sleep schedules, shared channels and alert fatigue.
Severity weights are arbitrary, not calibrated against an organisation's risk appetite.
The breaker counts events in a sliding window, with no per-user or per-tool scoping.
No legal, regulatory or contractual analysis of responsibility.
Optional real experiment (I did not run this): run a game day on a real agent: trigger a synthetic SEV2, time the acknowledgement, use the kill switch and reconstruct the incident from the audit log alone.
Check yourself
Who is accountable when an agent causes harm? (A named human or team in the organisation. The agent cannot be accountable, and you need logs to show what happened.)
For the curious A hash chain is not enough
Of five tampering attacks, a plain log detected 0. A hash chain detected edits, deletion and reordering but not tail truncation or a full rewrite by someone who recomputes the hashes. Re-paging the same person every 15 minutes never reached a human in 10 percent of incidents at 90 percent availability, and 30 percent at 70 percent. The attack, availability and traffic here are simulated.
What you will use daily at work
Practice
What it looks like
Log nine fields for each consequential action
Who, action, argument hash, decision, approver, model and prompt version, trace id, time.
Write the severity rule before an incident
Impact, reach and reversibility to SEV1 to SEV4.
Escalate to a rota, not a person
Re-page a different person if nobody answers.
Add a circuit breaker with a named human reset
It halts the agent after N suspicious events.
Draft: confirm your paging tool, who is on the rota, and your incident-reporting duties with counsel.
What you must be able to say (one page)
Accountability means a named human or team answers for what the agent did, and you can show what happened. An agent cannot be accountable; the organisation is. Accountability relies on comprehensive logging and traceability (decision logs with inputs, intermediate reasoning steps and outputs; user interaction logs with timestamps; error and failure logs), on ongoing behavioural audits (optionally by independent third parties), and on escalation design backed by organisational roles. It is not legal advice; who is legally responsible depends on contracts and law (module 10).
What to log for every consequential action: who or what acted, the action, a hash of the arguments, the decision (allowed, denied, approved), the approver, model version, prompt version, trace id and timestamp. My log refuses entries missing any of these nine fields. Redact personal data first (module 6).
Make the log tamper-evident. I tested five tampering attacks on five log designs (200 entries). A plain log detected 0 of 5. A hash chain (each entry commits to the previous hash) detected edit, deletion and reordering but not truncation of the tail and not a full rewrite by someone who recomputes the hashes. An HMAC chain with the key held elsewhere also caught the rewrite, but not truncation. Only an anchor (length and head hash kept in a separate system, such as a signed checkpoint or write-once store) caught all five. Verifying 100,000 entries took about 0.5 to 0.7 s here.
Rule-based triggers are auditable; model-judged ones are not. LLM-based delegation (the agent judges risk and confidence) cannot be audited the way rule-based delegation can: explicit triggers in code, such as transaction value limits, are deterministic and auditable. For example, a procurement agent may auto-approve purchases under $1,000 but need multiparty sign-off above that.
Severity needs a rule written before the incident. My matrix scores impact (0 to 3), reach (how many people or records) and reversibility, and maps to SEV1 to SEV4: for example minor impact, one record, reversible is SEV4; serious impact, 500 records, irreversible is SEV2; critical impact, irreversible is SEV1. The weights are my assumptions; the point is that irreversibility raises severity and that the rule is explicit.
Escalation must not depend on one person. In a simulation where each on-call person is unreachable for the whole incident with some probability (asleep, out of coverage), re-paging the same person every 15 minutes never reached a human in 10 percent of incidents at 90 percent availability, 30 percent at 70 percent and 50 percent at 50 percent. Escalating to the next tier every 15 minutes cut that to 0.1, 2.5 and 12.3 percent, with p95 time to acknowledgement of 23 and 39 minutes at 90 and 70 percent availability. Failures are correlated within a person, which is why repeating the same page does not help.
A circuit breaker (kill switch) stops damage while humans respond. It halts the agent after N suspicious events in a window and needs a named human to reset. With an attack of 6 attempts a minute, 60 percent flagged (assumed), harm before halting (mean of 20 runs) was 1, 2, 5 and 57 units for limits of 2, 3, 5 and 10 against 68 with no breaker; on normal traffic with 5 percent flagged, the limits produced 28, 3, 0 and 0 false trips per 8 hours. A limit of 10 almost never trips; a limit of 2 trips constantly. Tune against both.
Honest limits: simulated attack, availability and traffic; a toy log in memory; no real paging system, no legal analysis.