What should an AI agent audit trail record?
Enough to replay the decision without asking the agent. That means the task and who started it, the agent identity that acted, each tool call with its arguments and result, the model and prompt versions, timestamps, and every human approval or rejection. An audit trail records effects, not only model messages: the record a tool created, the email that left, the row that changed, each with an address someone can open.
How is an audit trail different from an agent trace?
A trace answers how the run went; an audit trail answers whether it was allowed and what it changed. LLM observability and the agent trajectory explain the reasoning path for debugging, and they are often sampled, trimmed or kept briefly. An audit trail is kept complete, in a store the agent cannot edit, because its job is evidence for auditability, not diagnosis.
How do we keep an agent’s audit trail honest?
Four rules govern the trails our agents and our client builds keep:
- Every action leaves a receipt, including the ones an agent may take without approval. Acting alone and recording the action are one obligation, not two.
- A refusal or error is recorded as a complete state. In LangGraph, state keeps keys a step did not return, so a refusal can silently merge with the previous run’s success artifacts. We reset everything the refusal invalidates and record which attempt was accepted, not the first one.
- A tool that creates something outside the system returns the created object’s address. “It worked” cannot be audited if nothing links to what was made.
- Reports come from what came back, not from what was dispatched. A worker that died returns nothing, and a summary written from the dispatch list invents a result, a rule we also apply to the supervisor agents we run.
Where integrity matters, the shape that survives our reviews is write-once records with a hash carried downstream, and we say plainly what a local design gives: tamper evidence, not tamper-proofing.
When does an agent audit trail matter?
As soon as an agent can change something a person would be asked about later. Keep records long enough for operational and legal needs, with access controls and data minimization, since AI compliance may require evidence that policies were followed. Design the trail before the agent gets write access, because a missing field cannot be backfilled. A log that omits the external result cannot prove what the agent changed.