Unstructured, disconnected
Text logs record lines, not decisions. They do not tie the turn sequence, the exact tool parameters, and the ALLOW/DENY/MODIFIED outcome into one coherent record.
MCP firewall capability
Proof-of-Intent Packaging
Raw stdout logs are notes, not evidence: they can be altered, and they rarely tie the agent's turn, the tool parameters, and the policy decision into one verifiable state. Proof-of-Intent converts each turn into a proof envelope, links every envelope to the one before it with a SHA-256 hash chain, and signs the assembled bundle with HMAC-SHA256. Verification recomputes the signature and re-walks the chain offline. The envelope references the tool result by hash, so you can prove exactly what happened without exposing raw responses or PII.
Evidence architecture
Every turn joins a hash-linked chain
For each agent-tool interaction the gateway builds a proof envelope and stamps it with a hash computed as Hash_N = SHA-256(EventData + Hash_(N-1)), so each entry carries a prev_hash that points at the previous turn.
Because every envelope links to the one before it, altering or deleting any past turn changes its hash and breaks every link that follows, the chain fails verification instantly. The assembled bundle is then signed with HMAC-SHA256 using the gateway's key, and verification recomputes that signature and re-walks the links, offline.
Event 000184
prev_hash + intent summary + decision + result_sha256hash: 9f2a…↓ linked by SHA-256
Event 000185
ALLOW · create_payee · reason: within declared intenthash: 11bc…↓ linked by SHA-256
Event 000186
DENY · create-then-pay chain held for human reviewhash: a904…Offline verification
Both the signature and the linkage are checkable with no call back to IntentGate. Export lands in Splunk, Microsoft Sentinel, or S3.
recompute HMAC-SHA256 · re-walk prev_hashBoth the signature and the linkage are checkable with no call back to IntentGate. Export lands in Splunk, Microsoft Sentinel, or S3.
Proof envelope
What each envelope carries
A proof envelope is metadata and signatures, not payload. It binds the parts that establish what was meant to happen and whether it was authorized, and references the result by hash. The raw response never enters the envelope.
Event id and timestamp
A unique, time-ordered event id and a timestamp give the turn a fixed place in the sequence, so the record can be reconstructed in order.
ORDERAgent and tool
The agent identity and the tool it tried to call, for example a billing copilot invoking a create-payee action, are bound into the envelope.
WHODecision, reason, intent
The policy decision, ALLOW, DENY, or MODIFIED, with the check that made it, a short human-readable reason, and a one-line summary of the declared intent.
DECISIONResult by hash
The tool result is referenced only as result_sha256, a digest that proves what came back without ever carrying the raw response or any customer data.
Chain and signature
A prev_hash links the entry to the previous turn, and the bundle carries an HMAC-SHA256 signature plus a key_id that names the signing key without exposing it.
Why raw logs are not evidence
Traditional stdout logs leave three gaps that matter the moment anyone asks a hard question. The hash-chained ledger closes all three with a single structure.
Non-deterministic liability
Auditors ask precise questions: did the user authorize this, and did a policy engine check it? Scattered logs cannot answer deterministically; a bound record of intent and decision can.
Tamper risk
Plain text can be altered, deleted, or spoofed. The prev_hash linkage makes any edit self-evident, a record anyone can quietly change is a note, not evidence.
What Proof-of-Intent actually does
Stated plainly, without overclaiming. The cryptography and offline verification are real; the parts that are optional or on the roadmap are marked as such.
Real hash chain, real tamper-evidence
The SHA-256 hash chain, its prev-hash linkage, the tamper-evidence that linkage provides, and offline verification are real and shippable. Each entry carries a unique, time-ordered event id.
HMAC-SHA256, gateway key
The bundle is signed with HMAC-SHA256 using the gateway's signing key, it is not an ECDSA node key pair. The key_id names the key without exposing it.
Hash of the result, never PII
The envelope references the tool result by result_sha256, so it holds a hash and never the raw response or PII. It still binds the declared intent, the tool, and the decision, which stay inside your customer boundary. What crosses the federation boundary is zero-payload: counts and hashes only.
SIEM and Kafka, both real
The local hash-chained ledger and SIEM export to Splunk, Microsoft Sentinel, and S3 are real and shipping, and the enterprise Kafka audit stream is now available too, opt-in and additive, never an inline dependency. Automated GRC auto-close into ServiceNow or OneTrust is not yet wired.
Related capabilities
Proving what happened is the evidence layer of the MCP firewall. It composes with the controls that clean what the model reads, decide whether a call should fire, and bound how much an agent may do.