# A Refused Write Is Evidence

Tamper attempt receipts for append only agent records

Published September 3, 2026.

## Quick answer

A tamper receipt should prove a narrow event: a mutation was requested, the protected root stayed unchanged, and the refusal was recorded after the request. It should not turn that event into an accusation.

## The problem

Agent systems produce transcripts, tool calls, scorer outputs, policy decisions, and checkpoints. An ordinary audit log can show the final record. It often cannot show that someone tried to change that record and failed.
The missing object is a signed refusal record. It binds a target receipt, a requester commitment, the requested operation, the refusal reason, the prior root, the observed root, and the relevant times. The service derives the outcome from those fields.

## Primitive map

| Receipt | Bound inputs | Derived relation | Claim boundary |
| --- | --- | --- | --- |
| tamper.attempt | Target receipt, attempt type, requester commitment, prior and observed roots, request and observation times | The roots match and the observation follows the request | Requester identity, intent, or log completeness |
| transparency.checkpoint | Log identity, tree size, root, and checkpoint time | A specific append only state existed at a stated size | That every relevant event entered the log |
| sequence.attestation | Ordered event commitments and sequence position | The supplied sequence is internally ordered | The truth of each event payload |

## Verifier gates

The verifier rebuilds derived values. It does not trust a caller supplied outcome, count, root, total, or relation.

- `SCHEMA`
- `ISSUER_KEY_MATCH`
- `ENVELOPE_SIGNATURE`
- `TARGET_RECEIPT`
- `ROOT_UNCHANGED`
- `OBSERVATION_ORDER`
- `OUTCOME_DERIVATION`
- `NON_ACCUSATORY`

## Failure cases

### Delete

A requested deletion is committed before the protected root is read again.
### Overwrite

The prior and observed roots show whether the protected state changed.
### Reorder

Sequence commitments expose a changed order when the verifier recomputes them.
### Backdate

Request and observation relations fail when the claimed order is impossible.
### Suppress

A witnessed refusal remains independently verifiable even if the application omits it later.

## Claim boundary

- It does not identify the requester.
- It does not infer malicious intent.
- It does not prove that the log was complete before the first independent witness.
- It does not prove the truth of facts inside the protected receipt.

## Standards context

- [SCITT architecture](https://datatracker.ietf.org/doc/html/draft-ietf-scitt-architecture-22)
- [RFC 9162](https://www.rfc-editor.org/rfc/rfc9162.pdf)
- [Sigstore Rekor](https://docs.sigstore.dev/logging/overview/)

## Related research

- [Swarm incident receipt autopsy](https://thehiveryiq.com/autopsy/openai-hugging-face-agent-evaluation/)
- [Hive research index](https://thehiveryiq.com/papers/)