How Black Box records and verifies an agent run
The design goal is one property: someone who doesn't trust the agent, or us, can still check what happened.
- 01Your agent
Unchanged. Its model and tool calls are pointed at the gateway.
- 02Gateway
Sits outside the agent and records every model and tool call as it passes through.
- 03Ledger
Each entry is hashed together with the one before it. Edit one and every later hash breaks.
- 04Verifier
Checks an exported ledger offline, built so a third party can run it.
- 05Replay
Step through exactly what was called, when, with what result.
What's recorded
Every model call and tool call that passes through the gateway: the call name, its arguments, the result, and a timestamp, in order. That is what the agent called, when, with what result.
Why outside the agent
The gateway sits between the agent and the things it calls. The agent has no write access to its own record, so it can't omit or rewrite a step, whether by bug or by prompt injection.
The hash-chain format
Each entry's hash covers the previous entry's hash plus the entry's own contents. The first entry chains from 64 zeros.
entry_hash = SHA-256( prev_hash + "\n" + canonical_json(entry) ) entry = [seq, timestamp, kind, name, args, result]
Change any field of any entry and its hash changes, which changes every hash after it. The tamper test on the home page uses this same construction.
Offline verification (in pilot)
The verifier takes an exported ledger, recomputes the chain from the first entry and reports the first entry that no longer matches. It is designed to run offline, so a third party can check a ledger without our involvement. It's in pilot, and we'll show it to you on the call.
What it doesn't do
- It doesn't prevent incidents or decide whether an action was correct.
- It only sees calls routed through the gateway.
- It shows the record is unaltered. It does not make the agent's decisions good.