AgentSystems Notary

Overview

AgentSystems Notary creates tamper-evident audit trails for AI agent interactions.

Why

When AI behavior is questioned by customers, auditors, regulators, insurers, etc., you need to prove what actually happened. Traditional logs don't work: you control them, so third parties have to trust you didn't modify them.

Tamper-evident logging removes that trust requirement.

How it works

Raw LLM interactions stay in your storage. No third party sees them during normal operation. But cryptographic hashes of each interaction are written to independent, tamper-evident storage (Arweave or the AgentSystems custodied service) at the same time.

If there's ever an audit or dispute, you provide the raw logs. The auditor re-hashes them and compares against the stored hashes. A match indicates the logs are unaltered. A mismatch indicates tampering or corruption.

You control your data, but can't alter it without detection.

What gets logged:

To your storage: full raw LLM payload (prompts, responses, metadata, timestamps)
To hash storage: SHA-256 hash + metadata (e.g. namespace, session ID, timestamps)

Hash storage options

Hashes (not raw data) can be written to either storage option:

Storage	Best For	Features
Decentralized (Arweave)	No vendor lock-in	Public append-only ledger, open-source verification, no account needed
`Custodied`	Managed compliance	Write-once storage, verification UI, signed attestations for audits

Info

Custodied plans offer WORM-compliant hash storage, managed signing, and signed attestations.

Prerequisites

pip install agentsystems-notary langchain langchain-anthropic python-dotenv

Example (decentralized)

Generate signing key
```
openssl genrsa -out arweave-key.pem 4096
```
Warning
Retain this key. It is required to prove ownership of on-chain hashes during verification.

For production, use a cloud key management service.

Create .env file

Create a .env file in your project root:

# AWS S3 for raw payload storage
ORG_AWS_S3_BUCKET_NAME=your-bucket
ORG_AWS_S3_ACCESS_KEY_ID=AKIA...
ORG_AWS_S3_SECRET_ACCESS_KEY=...
ORG_AWS_S3_REGION=us-east-1

# Path to signing key
ARWEAVE_PRIVATE_KEY_PATH=./arweave-key.pem

# Anthropic
ANTHROPIC_API_KEY=sk-ant-...

Run the example

import os

from agentsystems_notary import (
    LangChainNotary,
    ArweaveHashStorage,
    AwsS3StorageConfig,
    LocalKeySignerConfig,
    RawPayloadStorage,
)
from langchain_anthropic import ChatAnthropic
from dotenv import load_dotenv

load_dotenv()

# Your S3 bucket for raw LLM payloads
s3_config = AwsS3StorageConfig(
    bucket_name=os.environ["ORG_AWS_S3_BUCKET_NAME"],
    aws_access_key_id=os.environ["ORG_AWS_S3_ACCESS_KEY_ID"],
    aws_secret_access_key=os.environ["ORG_AWS_S3_SECRET_ACCESS_KEY"],
    aws_region=os.environ["ORG_AWS_S3_REGION"],
)
raw_payload_storage = RawPayloadStorage(storage=s3_config)

# Local RSA key for signing
signer = LocalKeySignerConfig(
    private_key_path=os.environ["ARWEAVE_PRIVATE_KEY_PATH"],
)

# Arweave for decentralized hash storage
# Namespace is public — written to the ledger and used to segment stored data
# Namespace should be one anonymous ID per customer, agent, or environment
# Retain a record of your namespace mappings
arweave_storage = ArweaveHashStorage(
    namespace="tenant_a1b2c3d4",  # See namespace comments above
    signer=signer,
)

# Create notary callback
notary = LangChainNotary(
    raw_payload_storage=raw_payload_storage,
    hash_storage=[arweave_storage],
    debug=True,
)

# Attach to model
model = ChatAnthropic(
    model="claude-sonnet-4-6",
    api_key=os.environ["ANTHROPIC_API_KEY"],
    callbacks=[notary],
)

response = model.invoke("What is the capital of France?")
print(response.content)

Verification

Decentralized (Arweave): Download raw payloads from your storage bucket, zip them, and verify with the open-source CLI:

aws s3 sync s3://your-bucket/arweave/tenant_a1b2c3d4/ ./logs
zip -r logs.zip logs
npm install -g agentsystems-verify
agentsystems-verify --logs logs.zip

The CLI re-hashes each payload and compares against the hashes stored on Arweave. See the full verification guide for details.

Alternatively, the Verify UI supports both decentralized and custodied verification.