A hash-chained audit system records every agent action in a tamper-evident timeline, detailing what was done, when, with which arguments, under which policy, and by whom.

This audit chain prevents tampering: altering any historical entry breaks the chain, delivering provable integrity beyond a simple timeline.

The guide provides practical installation and usage steps for the pod tool (v0.3.2), including initializing a baseline, starting a server, and generating and verifying evidence bundles.

Evidence is packaged into bundles that include the audit, a policy snapshot, self-check results, and a top-level hash so recipients can verify integrity without trusting the originating machine.

An optional cloud-enabled approach allows cross-agent evidence via pod sync, uploading only hashes while keeping audit text local to preserve local enforcement even if the cloud is unavailable.

A real-world runbook shows multiple agents (Claude Code, Cursor, OpenClaw, DSH) operating on a single host, including an incident where a policy denied an attempted file deletion.

Step 1 demonstrates replaying the timeline across time ranges, with each log entry capturing time, tool, server, agent, argument hash, decision, outcome, approver, and policy version.

A comparison highlights how hash-chained audits outperform plain logs by enabling tamper-evidence, including policy version and portable evidence bundles.

Step 2 shows how to verify integrity with a hash-chain check (pod verify-audit), confirming the head and tail hashes are intact and all records are verifiable.