Direct answer
AI agent actions should be audited as a chain of connected evidence: who authorised the work, which agent acted, what authority and policy applied, what the agent attempted, which tool or system executed it, what resource was affected and what outcome followed. Human approvals, denials and interventions should be part of the same record.
Audit the event chain, not just the conversation
A conversation explains how a task was expressed, but it does not prove what changed in another system. An agent may produce a sensible plan and then call the wrong tool. A tool may return an error. A remote service may accept a request but apply it differently from what the agent expected.
The audit model should therefore connect intent, authority, execution and outcome without treating them as the same thing. Each material step needs an identifier that allows related records to be joined across the agent runtime and the systems it uses.
Minimum chain: principal → agent → delegation → decision → action → target → result.
What an agent action record should include
The exact fields depend on risk, but a structured record will usually need:
- the human or organisational principal behind the task;
- the distinguishable identity and version of the agent;
- the delegated authority, role or policy evaluated;
- the task, session and correlation identifiers;
- the tool selected and the action requested;
- the target application, account, file or resource;
- the time, environment and relevant execution state;
- any approval request and the approver’s decision;
- the response, error, side effect or confirmed outcome.
For consequential actions, it is also useful to record what the agent expected to happen and how the outcome was verified. This separates a successful API call from a successfully completed task.
Do not confuse auditability with storing hidden reasoning
An audit trail needs enough decision context to explain why an action was selected, but it does not require unrestricted storage of every internal model token. A concise action rationale, the source material used, the policy result and the alternatives presented to the user may be more useful than a large and sensitive raw trace.
Prompts and model outputs can contain personal data, credentials or confidential content. Logging should be risk-based, access-controlled and minimised. High-impact actions need stronger evidence, while low-risk operations may need only a compact event record.
The audit system must protect its own integrity
An agent should not be able to silently rewrite or delete the evidence used to review its behaviour. Logs need appropriate access controls, reliable timestamps, retention rules and protection against tampering. In higher-risk settings, records may be sent to a separate security or audit system.
Identity and time must also remain consistent across systems. If the agent runtime uses one identifier and the target service records an unrelated user credential, investigators may be unable to connect the events. Shared correlation identifiers and explicit delegation references make the chain clearer.
An audit trail should support action
Logging everything without a way to review it creates storage, not accountability. Organisations need to decide which events trigger alerts, which require periodic review and how a suspicious agent can be suspended. Individual users need a readable history that shows what happened and allows them to revoke access or correct a result.
Practical test: after an unexpected change, can a reviewer determine who authorised it, which agent executed it, why it was allowed and what the system actually changed?
How this relates to Smallsoft Identity
Smallsoft’s identity architecture treats audit as the evidence layer connecting human principals, non-human identities and delegated authority. The aim is a traceable record across authentication, authorisation, approvals and agent actions.
Explore Smallsoft IdentityFrequently asked questions
Is a transcript enough for an AI agent audit trail?
No. A transcript may explain intent, but an audit trail also needs structured action events, identities, authority references, target resources, timestamps and outcomes.
Should an AI audit log store every prompt?
Not necessarily. Store enough context to explain and investigate material actions, using access control, minimisation and retention rules appropriate to the risk.
Who should be able to see agent audit logs?
Access should follow purpose and sensitivity. Users need visibility into their agents; security and compliance teams may need broader evidence; sensitive content should remain restricted.