# How do I make an AI agent's audit log append-only so even an admin can't silently delete entries?

**Short answer:** Database permissions alone can't do it. You can revoke UPDATE and DELETE from the agent's role, but PostgreSQL's own docs say a superuser bypasses all permission checks, and whoever runs the database can drop a trigger, restore an old backup or simply stop writing. So aim for two things: deletion that is blocked where the storage allows it, and deletion that is visible everywhere else. Number every entry and chain it to the hash of the one before, so a removed or edited entry leaves a gap or a broken link. Then copy each closed batch to write-once storage the admin can't shorten: S3 Object Lock in compliance mode, which AWS says no user, including the root user, can delete before the retention date, or a locked Cloud Storage retention policy. Finally, commit the chain head on a schedule to a record outside the admin's control, so cutting off the newest entries is caught too. On Rightshold, recorder_checkpoint commits your agent's signed log head to a public, hash-chained ledger whose blocks are timestamped in Bitcoin, checkpoints only move forward, and verify_recorder lets anyone check a disclosed stretch for gaps for free.

## Checklist
1. Write down who you are protecting the log from: the agent, the app's own service account, a database admin, a cloud admin. Each of these can remove a different layer, so each needs a layer it can't touch.
2. Give every entry a sequence number, a timestamp and the hash of the previous entry (seq 1 points at 64 zeros). Sign each entry with a key the log's admin doesn't hold, such as the agent's own key kept in a separate secret store.
3. In the database, give the writer role INSERT only. Revoke UPDATE, DELETE and TRUNCATE from it and from the app. Treat this as protection against the agent and the app, not against the database's superuser or owner.
4. Every hour or every N entries, write the closed batch and its last hash to a separate bucket with write-once retention: S3 Object Lock in compliance mode (not governance mode, which a user with s3:BypassGovernanceRetention can override), or a locked Cloud Storage retention policy. Put that bucket in a different account, owned by someone other than the log's admin.
5. Commit the chain head outside your systems on the same schedule: recorder_checkpoint on Rightshold, an RFC 3161 timestamp, an OpenTimestamps proof, or a copy to your auditor. Without this, an admin can delete the newest entries and the remaining chain still looks whole.
6. Check the chain on a schedule from a system the admin doesn't control: no missing sequence numbers, every prev hash matches, every signature verifies, and the newest entry is at or after the last committed head.
7. Alert when entries stop arriving or the checkpoint job fails. Silence is how a quiet deletion or a disabled logger looks from outside.
8. Write corrections as new entries that point at the entry they correct. Never edit an old entry, even to fix a typo.

## Why can't database permissions stop an admin from deleting an AI agent's audit log entries?
- PostgreSQL's documentation on role attributes says a database superuser bypasses all permission checks except the right to log in. REVOKE and triggers stop the application and the agent. They don't stop the person who runs the database, and they don't stop a restore from an older backup.
- Cloud storage has the same split. S3 Object Lock in governance mode can be overridden by a user with s3:BypassGovernanceRetention. In compliance mode, AWS says a locked object version can't be overwritten or deleted by any user, including the root user, and the only way to delete it early is to delete the AWS account. A locked Cloud Storage retention policy can't be removed or shortened.
- NIST SP 800-53 Rev. 5 control AU-9 (protection of audit information) lists the same layers as enhancements: store audit records on a separate system, protect them cryptographically, and limit who can manage them to a small group of privileged users.

## How do I detect deleted or cut-off entries in an AI agent's audit log?
- A hash chain makes edits and deletions in the middle visible: remove entry 41 and entry 42's prev hash no longer matches anything, or the sequence jumps from 40 to 42. It can't catch the newest entries being cut off, because what is left still chains.
- That is why the head has to leave your systems. AWS CloudTrail does this for its own logs: every hour it delivers a signed digest file that lists the last hour's log files with a hash of each, and each digest carries the signature of the one before. AWS says this lets you tell whether a log file was deleted or changed, or assert that no log files were delivered in a period.
- Certificate Transparency (RFC 9162) uses the same idea at internet scale: an append-only Merkle tree whose signed tree heads are checked by outside monitors, so a log can't quietly drop an entry it has already published.

## How often should I commit an AI agent's audit log head outside my systems?
- On Rightshold, the flight recorder keeps your log on your side. Each entry is {seq, at, kind, summary, prev}, hashed as sha256('rec:' + canonical(entry)) and signed with the agent's key. recorder_checkpoint publishes only the head hash and the entry count, signed by the agent, as a ledger entry.
- Checkpoints only move forward: one at or below the last committed seq is refused with checkpoint_not_newer, so a committed head can't be wound back. GET /v1/recorder/{RS number} shows the latest head to anyone.
- How often you commit sets the window you can lose. Entries written after the last checkpoint can still be removed without a trace, so commit at least as often as you would notice a gap: every hour, every 100 entries, and always right after a high-risk action.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "My agent's audit log is hash-chained and signed. Commit the current head (entry 5120) so an admin can't later delete entries or cut off the end without it showing."

```json
{
  "tool": "recorder_checkpoint",
  "arguments": {
    "checkpoint": {
      "agent": "<RS number>",
      "seq": 5120,
      "head": "<sha256('rec:' + canonical(entry 5120))>",
      "at": "2026-11-07T21:00:00Z"
    },
    "signature": "<agent key's Ed25519 signature over canonical(checkpoint)>"
  }
}
```
- Needs an API key and an agent whose key is proven. It's in the trust toolset (connect to /mcp?toolset=trust). Only the head hash and the count become public; your entries stay with you.
- verify_recorder is free and needs no key: disclose up to 1,000 consecutive {entry, signature} pairs ending at a checkpointed seq, and it reports any bad signature, any gap in seq, any prev that doesn't match, and when the head was committed.
- ledger_verify recomputes every hash, Merkle root, chain link and signature on the ledger, free. ledger_anchor returns a block's OpenTimestamps proof to check with ots verify, and ledger_witnesses lists the outside witnesses' cosignatures of a block header (ledger toolset).
- Keep personal data out of summaries. Use your own ids and hashes of the arguments, not names or emails.

_Rightshold never holds your log. It records the head hash and entry count you commit and checks excerpts you choose to disclose. It can't stop anyone from deleting their own copy, and it can't show that an entry was true when it was written, only that it existed in that form by the time its head was committed. Write-once storage, database permissions and monitoring are steps you run on your own systems. Not legal or compliance advice._

## Sources
- [PostgreSQL docs: Role attributes (a superuser bypasses all permission checks)](https://www.postgresql.org/docs/current/role-attributes.html)
- [Amazon S3: Locking objects with Object Lock (compliance vs governance mode)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html)
- [Google Cloud Storage: Bucket Lock (locked retention policies)](https://cloud.google.com/storage/docs/bucket-lock)
- [AWS CloudTrail: Validating log file integrity (hourly signed digest files)](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html)
- [RFC 9162: Certificate Transparency Version 2.0](https://www.rfc-editor.org/rfc/rfc9162)
- [NIST SP 800-53 Rev. 5: AU-9 (protection of audit information)](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)
- [Flight recorder on Rightshold](https://www.rightshold.com/recorder)

## Related
- [How to log every AI agent tool call for audit](https://www.rightshold.com/answers/how-to-log-every-ai-agent-tool-call-for-audit)
- [How to keep an agent risk/approval record outside the agent's editable session](https://www.rightshold.com/answers/how-to-keep-an-agent-risk-approval-record-outside-the-agents-editable-session)
- [How to prove small business books weren't edited after the fact](https://www.rightshold.com/answers/how-to-prove-small-business-books-werent-edited-after-the-fact)
- [How to build an agent audit trail tied to grant, spend cap and revocation](https://www.rightshold.com/answers/how-to-build-an-agent-audit-trail-tied-to-grant-spend-cap-and-revocation)

_Not legal advice. Updated 2026-11-07. JSON: https://www.rightshold.com/answers/how-to-make-an-ai-agents-audit-log-append-only-so-even-an-admin-cant-silently-delete-entries.json_