Every ship in the United States Navy keeps two record systems, and the institution goes out of its way to keep them apart.
The first is correspondence: letters, memoranda, directives, the paper bloodstream of a bureaucracy. It has its own manual, SECNAV M-5216.5, which prescribes formats, routing, signature blocks, and reply deadlines, and its own administrative machinery of control cards and tracking systems to make sure a letter that demands an answer gets one. Correspondence is drafted, revised, coordinated, and polished. Its job is persuasion and coordination, and the Navy is very good at it.
The second is the ship’s deck log, and it is governed by an entirely different authority, the OPNAVINST 3100.7 series. The deck log is not about persuasion. It is the chronological official record of the ship: every event of consequence, entered as it happens, by the watch that witnessed it. The two systems have different manuals, different custodians, and different purposes, and no one in the Navy mistakes one for the other.
It is worth reading what the deck log actually requires, because every line of it is an integrity control written decades before anyone called it that.
The log of the watch is written by the Quartermaster of the Watch, legibly, as the watch stands. Not by a historian afterward, not by the public affairs office, not by whoever tells the story best. The record is made contemporaneously, by the person on watch, and note the billet: the quartermaster keeps it. Only the Officer of the Deck signs the log at the end of the watch, and facsimile signatures are prohibited. A named, accountable officer puts a real signature on the record of the last four hours, every four hours, around the clock.
Corrections are where the discipline shows its teeth. Erasures are not permitted. An erroneous entry gets a single line drawn through it, so that the original remains legible, and the correction is initialed in the margin by the person who made it. A late entry is flagged with an asterisk. The Navy does not let its watchstanders delete their mistakes. It requires them to keep the mistake visible, add the correction beside it, and sign for the change. The record is append-only, and its error handling is not a weakness of the system; it is the system.
Then custody: on the first day of each month the original log leaves the ship, forwarded ashore for permanent retention. No one aboard, however senior, can quietly revise last month’s history, because last month’s history is no longer aboard to revise. And the instruction says plainly why all of this matters: deck log entries often constitute important legal evidence in judicial and administrative proceedings. When a collision or a grounding puts a ship in front of a board of inquiry, the board does not begin with the correspondence file. It calls for the log.
The correspondence file, by contrast, is allowed to be what it is. Letters are revised until they say what the command wants said. That is legitimate; coordination and persuasion are real work. But the Navy would never accept a well-written letter as a substitute for the deck log, because the two answer different questions. Correspondence records what an organization wishes to say about events. The log records the events.
Now look at how the industry currently governs AI agents, and sort its artifacts into those two drawers.
The policy document. The vendor’s assurance letter. The framework attestation, the approval memo, the model card, the responsible-AI statement. All correspondence: drafted, revised, coordinated, formatted for persuasion, and often genuinely useful. The field produces this drawer in volume, and it is not wrong to. But ask the deck-log question of the same operation. If a software agent holds real authority over money, records, or systems, where is the contemporaneous, append-only, identity-bound record its actions cannot avoid producing? Who is the quartermaster of that watch? Who signs it, where does the original go, and what would a board of inquiry actually call for after the incident?
For most agent deployments today, the honest answer is that there is no deck log. There is only correspondence about the ship.
The disciplines that close that gap are not novel, and that is the point. They are the deck log’s rules transposed to a new watch. An append-only, tamper-evident record instead of editable narrative; we say tamper-evident, and we do not say immutable, because the record’s integrity should be a property you can test rather than a certification anyone holds. A verifiable identity behind every consequential change, enforced where the agent cannot reach; on our own production repository that takes the form of a platform rule that rejects any change to the protected branch without a verified signature, with the signing keys pinned to hardware in a specific person’s hand. Corrections as new entries, never silent edits. Evidence retained, attributable, and re-runnable, so the account of what happened does not depend on anyone’s memory or anyone’s prose. Our published work states these as the properties a control plane must prove; the Navy has been operating them in ink since long before software.
The previous essay in this file argued that Grant’s quartermaster billet forged the doctrine that won a war: substrate before strategy, the ledger over the speech. The deck log is the same figure at sea. The quartermaster stands the watch and keeps the record, because the one who owns the substrate is the one who writes down what it actually did.
This distinction is why this site is organized the way it is. The log you are reading is the Deck Log, and essays like this one file under The Correspondence File, an architecture announced in this file’s founding essay. The names are the honesty. This essay is correspondence: it argues a position, it was drafted and revised, and it is formatted to persuade you. The receipts are elsewhere, in the deck log and in the records behind it, which is exactly where receipts belong. The Navy never confuses the two drawers. Neither should anyone deploying agents, and neither will we.