Tenbri

Tenbri is an open-source system for recording what AI agents decide and proving later that the record hasn't been quietly changed. It calls this an Agent Decision Record. Each record captures who acted, the rule and inputs behind the action, any human approval, and the eventual outcome. That gives teams a purpose-built evidence layer for agents that can issue refunds, change accounts, deploy software, or take other consequential actions. It's less about watching token counts and more about preserving an answer to the hard question that follows an incident, which is what the agent decided and on whose authority.

Ordinary application logs can show useful events, but the same people operating the system can usually edit, rotate, or delete them. Tenbri approaches the problem cryptographically. An agent writes a signed intent before a tool or function runs, then adds a signed outcome marked as successful, refused, or failed. Entries are appended to a hash chain and protected with Ed25519 signatures. Verification checks the canonical bytes, links, signatures, and key history against a fingerprint that the verifier controls. Change one stored byte and the chain fails at that entry. A retained checkpoint can also expose a truncated or forked history, so a neat-looking export isn't accepted on trust alone.

The project keeps the underlying format portable. Streams are plain files on storage the operator controls, with signing keys held separately from the record. Local disk, Cloudflare R2, and MinIO are listed as available, while full AWS S3 support is still in progress for the current beta. Teams can write records through Python, TypeScript, Rust, a command-line interface, or the tenbrid REST and gRPC service. Streams written through one interface can be verified through another. For a quick integration, adapters instrument the Claude Agent SDK, OpenAI Agents SDK, and LangGraph or LangChain. Other tools can use a Python decorator, a TypeScript wrapper, the CLI, or an API.

Tenbrid also serves a read-only web interface. It provides an overview of outcomes, error and refusal rates, decision timelines, traces, principals, subjects, and an integrity view. A user can filter the decision table, open an intent beside its approval and result, inspect the raw JSON, and download a receipt for offline verification. The interface can't write to a stream, and its bearer token stays in the browser tab. That makes it useful for investigation and review without turning the evidence viewer into another path for modifying the evidence. For very busy streams, the documented interface loads at most 20,000 entries in the selected time range, so operators need to choose a focused window.

What makes Tenbri distinct from a normal observability product is its concern with authority and independently checkable evidence. Traces explain how an agent ran, while Tenbri links a decision to its trace and preserves the policy version, principal, target, approval, and outcome. Receipts can prove selected entries without exposing the full stream. Optional encrypted bodies and subject-specific keys support erasure by deleting the relevant keys while keeping the surrounding chain verifiable. Action schemas in a tenbri.toml file can require particular targets, policies, approvals, and fields, then apply the same mapping in SDKs, at the server, and during CI checks. The query tools can filter records by policy version and return JSON to other systems. That matters after a rule changes because reviewers can find the decisions made under the earlier wording without manually piecing together unrelated service logs.

The separation between evidence and the system that produced it is deliberate. An auditor can receive a stream and a fingerprint through an independent channel, then verify it without access to the original agent environment. A receipt narrows that handoff further by proving one selected event and its inclusion without disclosing every other decision. Tenbri still can't prove that an input was truthful or that a policy was sensible. It proves the integrity and stated context of what was recorded.

Tenbri fits engineering, security, governance, and audit teams that run agents with real authority and need stronger records than screenshots or editable exports. It's Apache 2.0 software written in Rust, has no telemetry, and is available without a commercial plan. The current release is explicitly a prerelease beta, and several items such as additional cloud stores, witnesses, hardware key support, and exports remain on the roadmap. Setup therefore expects comfort with keys, storage, schemas, and agent instrumentation. The project also says that its records can support reviews under regulatory or control frameworks, but they don't make an agent system compliant on their own. For teams willing to operate the evidence layer themselves, it offers a concrete and inspectable foundation rather than a hosted promise.