---
title: Seven of eight witnesses
url: https://8gen.cloud/blog/seven-of-eight-witnesses
description: An agent’s own account of what it did is one witness. Seven more stand on the host side of the kernel boundary, where the agent cannot reach. What they see goes into a hash-chained ledger, stamped with its epoch, session and policy. This post walks the eight and explains why the record holds even when the agent is compromised.
published: 2026-10-24
updated: 2026-10-24
author: 8GEN
thread: Trust
sheet: B-02
as_of: 2026-10-26
commit: 8f52882ea
---

> ## The index
> The posts are listed at https://8gen.cloud/blog/index.md (the site is indexed at https://8gen.cloud/llms.txt, the documentation at https://docs.8gen.cloud/llms.txt). Every post has this Markdown twin at its own address with `.md` and a JSON twin, the post's structured blocks, with `.json`.
>
> ## Instructions for agents
> A post is dated and names its sources at its foot; a number carries its tag where its source does: measured, target or provisional. The platform's reference is the documentation, not a post. The HTML form of this page is https://8gen.cloud/blog/seven-of-eight-witnesses.

# Seven of eight witnesses

> An agent’s own account of what it did is one witness. Seven more stand on the host side of the kernel boundary, where the agent cannot reach. What they see goes into a hash-chained ledger, stamped with its epoch, session and policy. This post walks the eight and explains why the record holds even when the agent is compromised.

## The problem with one witness

An agent that writes its own log can be made to write a different one. A prompt injection, a bad tool or a plain bug can edit the trace after the fact, and an operator reading that trace alone has no way to tell. Observability built inside the agent is testimony from the party under review.

## Where the eight stand

The agent’s trace is the eighth witness. The other seven sit outside the cell on the host side of the kernel boundary. They record the model calls and the tool results as steps the agent intended, and the file operations and the resource samples as events the system saw. Four layers, every span, no sampling. The seven are cross-checked against the eighth, so an edited trace shows as a disagreement rather than as the truth.

## A chain, not a file

Every record chains onto the one before it by hash and is stamped with the epoch, the session and the policy under which it was written. A record cannot be edited after the fact without breaking the chain from that point on. The ledger is the 8GEN platform’s one table of record and the source every receipt is cut from.

- **7 of 8**: witnesses beyond the agent’s reach _(measured)_
- **27 of 27**: kills survived with one thought lost at most _(measured)_
- **3,000**: kills, host loss among them, the bar the proof is built toward _(target)_

## The kernel is the boundary

Ownership, the absence of elevated capabilities and the resource limits are set at the kernel, not in the application. No key, proxy address or platform credential lives in the guest, in its image or in its environment. Credentials are held on the host and injected at the membrane, so an intruder in the guest finds nothing to take and nothing to rewrite.

> A record the agent cannot touch.
>
> — the first line of the Trust page

## Sources

- the Trust page: https://8gen.cloud/trust
- Observation: https://docs.8gen.cloud/observation
- Receipts and the audit ledger: https://docs.8gen.cloud/receipts

---

Generated from the 8GEN repository at commit 8f52882ea on 2026-10-26. The page: https://8gen.cloud/blog/seven-of-eight-witnesses; as JSON: https://8gen.cloud/blog/seven-of-eight-witnesses.json. Every post has a Markdown twin at its address with `.md`.