append-only log

An append-only log is a way of keeping records where whatever has been written is never erased or edited; new entries are only ever added on at the end.

Think of a company meeting minutes as an analogy. Normal documents let you erase mistakes or paint over them with correction fluid, but an append-only log doesn't allow that kind of editing at all. Whatever line has already been written stays exactly as it is, and anything new that happens gets added only as a new line at the bottom. So if you read it from start to finish in order, you can trace back exactly what happened and in what sequence, without missing anything.

This approach matters more now because programs like AI agents—which open files on their own, run commands, and approve or deny permissions—are becoming more common. If something goes wrong later, checking exactly what the agent touched and on what basis requires that the record itself remain untampered with. An append-only log is the mechanism that guarantees that trust.

As one article puts it: 'Every model message, tool call, tool execution result, permission approval/denial decision, and task completion event is recorded without exception in an append-only log.' Here, append-only log doesn't just mean 'a record is kept'—it emphasizes that the record can never be erased or rewritten afterward. It's easy to confuse this with an ordinary log file, but the key point isn't the storage format—it's the principle of 'no modification allowed.'

If you ever use an AI coding agent or automation tool, you can try asking it this way:

As you carry out this task, record each step's decisions and execution results in an append-only manner. That means never deleting or modifying previously recorded entries—always add new content only as a new line at the end.

Asking this lets you check how the tool actually keeps its logs, and whether it truly only appends to the end.