AI agents can now carry out tasks on their own — running code, calling external APIs, and making decisions without direct human oversight at every step. That autonomy creates a basic trust problem: when an agent acts independently, how can anyone be sure the results are accurate, repeatable, and free from tampering? In regulated or mission-critical settings the question is not academic. The EU AI Act, for example, requires automatic record-keeping (logging) and traceability for high-risk AI systems under Article 12, with logs that are tamper-evident and retained for a defined period.
Most agent workflows still rely on ordinary log entries or short-lived records that can be altered or forged. Addressing this calls for a different foundation — one that binds data and code together cryptographically, makes processing reproducible, and produces an audit trail that cannot be quietly rewritten. Several established techniques combine to make that possible.
Content-addressed artifacts
The first building block is content addressing: identifying code and data by the cryptographic hash of their contents rather than by a name or location. Because the identifier is derived from the bytes themselves, any change produces a different hash, so it becomes impossible to swap an artifact silently. This gives every input and output a verifiable fingerprint that later steps can check against.
The new era of AI: Train once, predict forever in production AI
Why will the future of AI systems be driven by inference and agent workload?
Deterministic and reproducible execution
Knowing which code ran is only half the problem; determinism ensures it produces the same result every time. Large language models have traditionally been non-deterministic, but recent research shows this is not inherent. Work by Karvonen and colleagues found that with fixed random seeds and sampling parameters, repeated runs produced more than 98% token-identical output. Going further, the EigenAI project reports bit-exact deterministic inference on production GPUs — identical outputs across thousands of runs with only a small latency overhead — by carefully controlling the execution environment and removing sources of non-determinism. Pairing that with cryptographic logging of requests and responses reduces validation to a simple hash comparison, giving each result a self-contained proof of correctness. Where full determinism is impractical, reproducibility commitments offer a lighter alternative, with an agent declaring the conditions under which its result can be regenerated.
Runtime isolation and sandboxing
Trust also depends on containing what an agent can do. Running generated code inside a strong sandbox — for example a WebAssembly (Wasm) runtime with strict memory and time limits — avoids the shared-kernel risks of conventional containers and limits the blast radius if something goes wrong. The guiding principle is that autonomy should be earned through demonstrated trustworthiness rather than granted by default.
Why does AI security break down at the system level?
AI security shifts from the model to the system level. As AI becomes agentic and tool-driven, risks emerge from complex interactions, increasing the gap between assessment and real-world behavior.
Tamper-resistant logging and proof bundles
Isolation and determinism govern what an agent does; logging holds it accountable for the actions it takes. Ordinary logs lack cryptographic linkage, so entries can be deleted or edited without detection. A stronger approach is an append-only, Merkle-chained audit trail in which each entry’s hash incorporates the previous one — so any deletion or modification immediately breaks the chain. Some designs go further by having each agent-to-tool transaction hashed and signed by both parties, so no entry can be secretly inserted or altered. Bundled together, content hashing, reproducible execution, and a signed hash chain let any party replay the recorded sequence and confirm that the agent’s actions matched its stated intent and policy.
3 easy ways to get the most out of cloud code
Everyone is talking about cloud code. With millions of weekly downloads and a rapidly growing feature set, it has quietly become one of the most powerful tools in a developer’s arsenal. But most people are barely scratching the surface.
Toward a trusted agent ecosystem
Combined, these techniques create a layered trust framework: agents are tied to specific code through signed certificates, models run deterministically under fixed conditions, execution happens inside an isolated sandbox, and every interaction is recorded in a tamper-evident hash chain. The result is end-to-end auditability. Interest in this direction is growing, with academic work formalizing on-chain and cryptographic verification, early commercial tooling appearing, and regulation such as the EU AI Act pushing organizations to demonstrate reproducibility and tamper-resistant logging for high-risk uses.
Limitations and what to watch
These approaches are promising but still maturing. Bit-exact determinism currently depends on tightly controlling the hardware and software stack, which is harder across heterogeneous or cloud environments, and reported figures generally come from the teams proposing the methods, so independent replication matters. Cryptographic logging and on-chain verification add computational, storage, and governance overhead, and they prove that a process ran as recorded — not that the underlying model’s judgments were correct. Several of the specific frameworks in this space are early-stage research, and standards are not yet settled. Organizations exploring verifiable agents should treat the building blocks as complementary, validate performance and cost on their own workloads, and watch how regulatory guidance and interoperability standards develop. Related reading on giving agents safe, scoped access can be found in this look at practical agent use cases and their security trade-offs.
