Across governance, security, and law, independent research groups are arriving at the same conclusion: AI systems need records that anyone can verify and no one can quietly change. That is not a product feature. It is critical infrastructure, and it has already been built. Yet, most of the teams that need it do not know it is ready to use.
An AI system makes a decision. It approves or denies a loan. It flags an insurance claim. It routes a patient, prices a policy, or executes a trade. Weeks later, someone asks a simple question: what actually happened, and can you prove the record of it was not changed after the fact?
For most systems in production today, the honest answer is no. With Auto Drive, Autonomys Network’s gateway to permanent storage, it does not have to be.
The problem is mundane. Conventional logs are entries in a database, and entries in a database can be edited. In a 2024 joint advisory, the U.S. Cybersecurity and Infrastructure Security Agency, the NSA, and allied cyber agencies note that “some malicious actors are known to modify or delete local system event logs to avoid detection and to delay or degrade the efficacy of cyber security incident response.” The record exists. Its integrity does not. That gap is harmless when a log is a debugging convenience. It stops being harmless when the log is the only evidence of what an autonomous system actually did.
What makes this moment different is not one paper or one company. It is that researchers working from unrelated starting points have converged on the same missing piece within the span of weeks.
Start with governance. In “AgentBound: Verifiable Behavioral Governance for Autonomous AI Agents,” Anuj Kaul, Qianlong Lan, and Pranay Gupta describe a shift in what it means to govern an autonomous system. AgentBound, they write, provides “a deterministic governance layer between authorization and execution, transforming governance from a process that must be trusted into one that can be independently verified.” That distinction is the whole point. A policy you have to take on faith is not a control. A policy whose enforcement leaves a record anyone can check is. AgentBound builds on an idea it names, a “Right to History” for agents, and cites work on “tamper-evident agent execution records” that let an agent’s past be proven rather than asserted.
Security research is arriving from another direction. In an early formal model titled “Toward Cryptographically Verifiable Authorization for Autonomous AI Agents,” M. Llambí-Morillas and D. Fernández-Fernández propose treating authorization itself as something you can prove. In their words, “Authorization decisions for autonomous AI agents can be represented as cryptographically verifiable relations that jointly bind an agent principal, a concrete authorization request, an execution context and satisfaction of an applicable policy.” Put plainly: it is not enough to see what an agent did. You should be able to prove it was allowed to do it.
The same idea is already being built into working systems. A benchmark for AI trading agents hash-chains every decision an agent records, so that any change to the record announces itself. The authors note that “an inconsistent edit… breaks the chain at the first altered record.” This is a finance evaluation tool, not a governance manifesto, and that is exactly why it matters. When practitioners building unrelated systems independently reach for the same construction, it has stopped being a novelty and started being vital infrastructure.
Here is where a weaker argument would overreach, and where the research is more honest than most marketing.
A permanent, tamper-evident record is necessary. It is not, on its own, sufficient. The most rigorous paper in this group makes precisely that point. In “From Runtime Records to Legal Findings,” Jeroen Janssen of Apparens sets a bar for when an AI system’s records can actually support a legal or regulatory finding, and he is blunt about the limit: “The claim is one of necessity, not sufficiency.” A record can be perfectly tamper-evident and still prove nothing, because, as he writes, “It may be incomplete, curated, falsely typed, produced in bad faith, or paired with incompetent decision-making or delayed intervention.”
This is the right way to think about it, and it strengthens the case for permanent storage rather than weakening it. You can layer structure, context, and human oversight on top of a record you can trust. You cannot add trust back to a record that was silently changed. Integrity is the floor. It is also the one part of the stack you cannot retrofit. Everything else in an audit trail can be improved after the fact. Whether the underlying record can be altered cannot.
For anyone deploying AI in a regulated context, these records are quietly becoming legal instruments. Memory with delete rights is policy. Memory without them is evidence.
The clearest example is the EU AI Act. Its record-keeping requirement for high-risk systems, Article 12, requires those systems to allow for the automatic recording of events across the entire lifetime of the system. Logs that persist. Logs that hold up. In practice, that means records that are permanent, that cannot be altered, and that can be verified.
The timeline is worth stating accurately, because precision here is itself a form of credibility. In 2026, the European Union’s Digital Omnibus package deferred the high-risk obligations. Stand-alone high-risk systems in the EU AI Act’s Annex III must now comply by December 2, 2027, and high-risk systems embedded in regulated products by August 2, 2028. The transparency obligations, including the requirement to disclose when a user is interacting with AI, took effect on August 2, 2026 as originally scheduled. The requirement did not shrink. The clock reset. For record-keeping failures, the Act’s penalties reach up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
The strategic reading is straightforward. A deferred deadline is a design window, not a reprieve. Organizations that use the extra runway to build on records they can prove will be ready when the date arrives. Those that treat it as permission to wait will be rebuilding their evidence trail under pressure, which is the most expensive time to do it.
Strip away the different vocabularies, and every one of these papers is describing the same property: a record that is always available and that no one can change without detection. That is a storage problem before it is anything else.
It is the problem Auto Drive was built to solve. Auto Drive is a storage service from the Autonomys Network that keeps data permanent and immutable. Two words that often get blurred are worth separating here, because the difference is the entire value. Permanent means the data is always available. Immutable means it cannot be changed. Most storage gives you one of these, or neither. Auto Drive gives you both.
The contrast with the most popular options? Centralized cloud storage can be deleted or modified by whoever controls the account. Pinning-based storage keeps your data only as long as you keep paying to pin it. Auto Drive holds data across a globally distributed network of nodes with no pinning to maintain, no expiration date, and anyone can confirm that a file was not altered without having to trust the party that stored it. That verification does not depend on reading the contents, so the file can be encrypted. Teams that need privacy can choose to encrypt a file and hold their own keys. Anyone can still verify the record is unaltered, but only the key holders can decrypt the file. No single party, Autonomys included, can rewrite or remove a record. That is what turns a log into evidence.
For teams building where the record must withstand scrutiny over time, this is available today, not on a roadmap. Auto Drive is free to start, with 20 MB of upload and 5 GB of download each month at ai3.storage, and the Subspace Foundation Grants Program (the Subspace Foundation oversees the Autonomys Network) coordinates larger storage grants for teams building where permanence is not optional.
In recent weeks, from a dozen directions at once, independent researchers pointed at the same missing layer: a record no one can alter in secret. A history you can prove may not be the whole answer to trustworthy AI, but nothing else works without it.
Фундаментальный уровень для AI3.0
