After an incident, the first thing a security team asks is what the agent actually did and who allowed it. A log helps only if people believe it. If records can be edited quietly, the log is a story, not evidence.
The idea behind a hash chain
Each record stores a SHA-256 hash that is computed from its own content and the hash of the previous record. Change an old record and its hash changes. That breaks the link to the next record, and every record after it no longer matches.
Why it is useful in practice
- Tampering is detectable instead of silent.
- Verification does not require trusting the dashboard.
- Every decision is covered, including BLOCK and ESCALATE.
- A single evidence hash can be cited in a ticket or a review.
What it does not do
A hash chain shows that records were not changed. It does not prove the policy was a good one. That is why Aegisora records the policy version with each decision, so a reviewer can see both what was decided and under which rules.