Auditors discount logs that cannot prove their own integrity, and they are right to. A normal log is testimony: the operator's word for what happened. A sealed hash chain is evidence: anyone can recompute it, and a single altered byte breaks it. SwitchTender records what an agent changes before the change executes, holds it at a human gate, and signs the trail so a third party can check it without trusting your server.
Six properties, each one testable against a running server. Together they turn agent activity into a record an auditor can rely on.
Every mutation is written into the audit chain before its handler runs. If the record cannot be written, the change is refused with a 503 instead of performed silently. There is no path where an agent changes something and nothing is written down.
Every mutation returns an Audit-Receipt header naming its sequence and hash. Keep them. A receipt later proves the chain still holds that exact entry at that exact position, so an omission is detectable by the party it happened to.
Secrets are sealed on the server and decrypt only at execution, so an agent holds exactly one credential: its SwitchTender token. It never sees an SSH key, a cloud login, or a vault password. Revoking that one token shuts the door.
One empty approval policy gates every run. An agent can queue work all day, and nothing executes until a person releases it. The gate is enforced in the dispatcher, so API-driven and scheduled runs are held the same as manual ones.
switchtender audit bundle emits the chain as a signed LoomSeal bundle. It verifies on a machine with no network and no SwitchTender install, against the key the server publishes at /.well-known/loomseal.json.
Every entry names the actor behind it, so an agent's changes stay attributable instead of blurring into a shared account. The live demo seeds a deploy-bot service account whose API and scheduled runs, and their audit entries, are on screen right now.
An agent with a pile of credentials has a pile of doors. An agent with one credential has one, and SwitchTender puts a gate on it. switchtender token new --user binds a token to an account, so a token bound to an operator carries the operator role: it can submit runs, but it cannot approve its own work and it cannot change configuration. Add one empty approval policy and every run the agent submits waits for a person. Four commands take you from nothing to an agent whose entire history is evidence.
switchtender user new deploy-agent --role operator --db switchtender.dbswitchtender token new --name deploy-agent --user deploy-agent --db switchtender.dbcurl -s -X POST localhost:8080/v1/policies \
-H "authorization: Bearer $ADMIN_TOKEN" \
-H 'content-type: application/json' \
-d '{"name":"gate-everything"}'switchtender audit bundle --db switchtender.db --out evidence.jsonThis page is about external agents driving the API. The built-in advisory AI is a separate feature: it proposes text and never executes anything.
An honest page beats a loud one. The chain proves the record was not altered. It does not prove that every change in your infrastructure went through SwitchTender: a person or a process holding its own SSH key can still change a host behind the controller's back, and no audit system can write down what it never saw. For agents, credential scoping is what closes that gap. An agent that holds only a SwitchTender token has no way around the controller, so for that actor, the recorded history and the actual history are the same thing. The gate is its only door, which is exactly what makes the logbook complete.