t3ai-Ledger
An append-only record of AI-assisted decisions: what the model produced, who acted on it, and under which policy. Designed to be independently verifiable against an exported archive, without access to the system that produced it.
Three properties, not three adjectives
Trust
An entry carries a signature. Who wrote it is something a reader can check, not something the record asserts about itself.
Transparency
A decision can be reconstructed afterward by an auditor with access, without taking anyone’s word for it.
Traceability
Each entry links back to the input, the source of what the model produced, the person who acted, and the policy in force at the time.
Logs are not evidence
A model drafts something. A person approves it, edits it, rejects it, or never sees it. Later somebody asks what happened: a regulator, a customer, a court, an auditor, or the system on the other side of a transaction.
The answer has to hold up. What the model produced, and what it drew on. Who acted on it, and under which rules. What went out, and whether it has changed since.
An ordinary log cannot answer that in a way anyone has to accept, because the people who run the system can also edit it. It records what happened, and it records what somebody wanted recorded, and from outside there is no way to tell which.
What one entry holds
A model drafts a claim, suggests an option, or produces a piece of work. Somebody confirms it, edits it, rejects it, or sends it up the line. That moment is one entry.
The entry holds what the model produced and what it drew on, who acted and in what role, which version of which policy applied at the time, and what finally went out. It is signed by whoever wrote it and carries a fingerprint of the entry before it, so a later change to any of it shows.
Nothing is overwritten. A correction is a new entry, and the original stays where it is.
A separate program that checks it
The record is designed to come with a verifier: a second program that can read it and cannot write to it.
It is designed to run against an exported copy, with no connection to the system that produced it: to recompute every fingerprint, check every signature, confirm the chain runs unbroken from one end to the other, and report the first point where any of that fails.
That is what makes a record evidence rather than testimony. Anyone you hand a copy to can run the check themselves, without access to anything of yours and without taking your word for it.
Your systems keep your material
The record points at things rather than holding them. A model output, a source document, a published file: each one is referenced by a fingerprint and a version, and the file itself stays in the system that already holds it.
So nothing has to move. What the record carries is identifiers, versions, role labels and reason codes, which keeps it small enough to hand to somebody. The next part depends on that.
Erasure without breaking the chain
A record that cannot be changed and a person's right to be erased pull against each other. The way out here is structural rather than procedural.
No personal data goes into the record itself. Where something has to be tied to a person, it sits encrypted in a separate store under a key held for that person alone. Erasing them destroys the key, so what it pointed at becomes unreadable while the chain and its signatures stay checkable. The entry survives as proof that something happened. The material it referred to is gone.
The erasure is itself an entry.
Written up as it gets built
Occasional notes on records, provenance and accountable systems.
Subscribe