Proof, not promises: how every agent action becomes cryptographically auditable

Our brand film compresses the position into a single line: proof, not promises. It sounds good — but what does it mean technically? This post walks through exactly what happens between an agent action and an auditor, and why the difference between an ordinary audit log and a cryptographic chain is decisive for regulated Swiss industries.

The problem with ordinary audit logs

A classic audit log is a file an application writes to. It answers the question "what happened?" only as far as you trust whoever operates the log. Because a log you can write to is a log you can alter after the fact — delete a line, shift a timestamp, insert an entry. For everyday operations that's fine. For a FINMA review or a Swissmedic inspection that shows up eighteen months after an incident and asks "can you prove what the agent did?", a vendor's assurance is not enough.

The hyperscaler platforms solve this contractually: a service-level agreement guarantees the integrity of the log. That's a legal promise, not a mathematical property. We wanted to dissolve the difference structurally — so that integrity isn't assured, it's verifiable.

What happens on every action

When a Dxzio agent performs an action — a tool call, a data query, an escalation to a human — that action passes through three steps before it counts as complete.

1. Sign. The action is canonically serialised (agent identity, timestamp, tool, arguments, result hash) and signed with the agent's private Ed25519 key. The private key never leaves the agent's process space; it is fetched from OpenBao at runtime and never persisted as plain text. The signature binds the exact content of the action to precisely this agent.

2. Anchor. The hash of the signed action is appended as a leaf in a Merkle chain. Each new entry incorporates the root of the previous state, so every action is cryptographically bound to its entire history. Altering a single earlier line would invalidate every subsequent root — that is computationally impossible to hide.

3. Commit. Only once signature and anchor are in place does the action count as committed. The proof is therefore not an after-the-fact log entry, but part of the execution path itself.

What an auditor actually does

The crucial point: verification does not need us. An auditor receives three things — the signed action, the agent's public key, and the Merkle root of the anchor log. With those, they check, offline and independently:

• Authenticity: verify the Ed25519 signature against the public key. If it holds, the action provably came from this agent and was not altered after signing.
• Chain integrity: recompute the Merkle path from the leaf to the published root. If it holds, the action was present, in exactly this order, at the time of anchoring.

No access to our systems, no "trust us", no way for us to influence the result. This is precisely the story platforms with after-the-fact-modifiable logging pipelines structurally cannot tell.

Why execution in WASM is part of it

A proof is only as valuable as the control over what was allowed to happen in the first place. That's why the agent runtime executes tool calls in WASM sandboxes. Each agent's manifest is signed and defines the exact list of permitted tool calls; anything outside that list is rejected before the tool code is ever loaded. The auditable chain therefore documents not only what happened, but operates within a frame in which nothing undeclared could happen.

What this means for your oversight

For the revised Swiss Data Protection Act (nDSG), FINMA Circular 2023/1 and Swissmedic MDR requirements, the burden of proof shifts. Instead of an assurance that your audit log is unaltered, you hold a proof your own examiner can compute — years after the event, without our involvement. That is the difference between "we promise you" and "compute it yourself."

If you'd like to see what this looks like for your specific use case, get in touch: www.dxzio.one · contact@dxzio.one

The 90-second film on the position: youtu.be/vyXWFMVGXwU