Brian Kuan has released Halo-record, an open-source Python package that creates tamper-evident, hash-chained audit trails for AI agents to provide verifiable logs of their actions and data access.

Key Points

• Halo-record uses hash-chaining to ensure that any modification to an AI agent's log file breaks the sequence, making unauthorized edits immediately detectable.
• The tool integrates with existing frameworks like LangChain, OpenTelemetry, and MCP servers to capture tool calls, model interactions, and data access.
• To protect sensitive information, the package automatically redacts raw arguments and stores hashed summaries instead of plain-text data.
• The project aims to address security requirements from standards like the EU AI Act and the Cloud Security Alliance’s AARM model.
• Kuan plans to offer a hosted witness service to verify that no log entries were deleted, addressing the limitation that hash-chaining alone cannot prove completeness.

Why it Matters

This tool provides a standardized, verifiable way for vendors to prove AI agent behavior during security audits, replacing subjective self-reporting with objective evidence. By enabling independent verification, it helps companies meet emerging regulatory mandates and insurance requirements while accelerating the enterprise sales process.