Agent Audit Trail Skill

Tamper-evident, hash-chained audit logging for AI agents. EU AI Act compliant.

Why

AI agents act on your behalf. From 2 August 2026, the EU AI Act requires automatic logging, tamper-evident records, and human oversight capability for AI systems. This skill provides all three with zero dependencies.

Quick Start

1. Add to your agent's workspace

cp scripts/auditlog.py /path/to/your/workspace/scripts/
chmod +x /path/to/your/workspace/scripts/auditlog.py

2. Log an action

./scripts/auditlog.py append 
  --kind "file-write" 
  --summary "Created config.yaml" 
  --target "config.yaml" 
  --domain "personal"

3. Verify integrity

./scripts/auditlog.py verify
# Output: OK (N entries verified)

Compliance Mapping

EU AI Act Article	Requirement	How This Skill Helps
Art. 12 Record-Keeping	Automatic event logging	Every action logged with timestamp, actor, domain, target
Art. 12 Integrity	Tamper-evident records	SHA-256 hash chaining — modification breaks the chain
Art. 14 Human Oversight	Human approval linkage	`--gate` flag links actions to human approval references
Art. 50 Transparency	Auditable records	Human-readable NDJSON, one-command verification
Art. 12 Traceability	Chronological ordering	Monotonic `ord` tokens

Event Kinds

Use these standardised event types for consistent audit trails:

Kind	When to Use
`file-write`	Agent creates or modifies files
`exec`	Agent runs a command
`api-call`	External API interaction
`decision`	AI makes or recommends a decision
`credential-access`	Secrets or credentials accessed
`external-write`	Agent writes to external systems
`human-override`	Human overrides an AI decision
`disclosure`	AI identity disclosed to user

Full Documentation

See README.md for complete usage, integration examples, security model, and EU AI Act compliance guide.

Log Format

{
  "ts": "2026-02-24T07:15:00+00:00",
  "kind": "exec",
  "actor": "atlas",
  "domain": "ops",
  "plane": "action",
  "target": "pg_dump production",
  "summary": "Ran database backup",
  "gate": "approval-123",
  "ord": 42,
  "chain": {"prev": "abc...", "hash": "def...", "algo": "sha256(prev\nline_c14n)"}
}

OpenClaw Integration

Add to HEARTBEAT.md:

## Audit integrity check
- Run: `./scripts/auditlog.py verify`
  - If fails: alert with line number + hash mismatch
  - If OK: silent

Requirements

Python 3.9+ (zero external dependencies)
MIT License

Built with 🔐 by Roosch and Atlas

agent-audit-trail

Installation