Agent audit trails — proving what an agent did

An AI agent moved money last month. Today someone asks: what did it do, for whom, and why? You need records that nobody could quietly edit. Your goal: know what a good agent record holds, and how to make it tamper-evident.

Why agents need a richer record

Human clicks are slow and few. Agents act fast, in large numbers and through chains of other agents. A person might approve five payments a day. Kai might try five hundred. Some are for Maya. Some pass to Sam's agent by delegation. A thin log line like "user X did action Y" leaves you blind when an agent misbehaves. Agents need an audit trail built for machines: every action, described richly and kept for good.

What a good agent audit event holds

The "who" ties to agent-to-agent delegation: record the whole chain, not just the last machine. The "why" ties to human-in-the-loop approvals. A payment with no approval reference is a red flag, not a normal line.

Append-only and hash-chained

A trustworthy trail is append-only. You add entries, and you never edit or delete them. Each entry holds a hash that includes the hash of the entry before it. This is a hash chain. Change one old row, and the next row no longer matches. Even if the attacker recomputes that row's own hash, the next row still holds the old one. The break spreads to every later row. You cannot change history quietly.

Your bank passbook works the same way. Each line shows a running balance that depends on every line before it. Change one old line, and every balance after it looks wrong.

There is one catch. An attacker who can recompute every later hash could hide the change. So store or sign the newest hash where the log writer cannot reach.

The trail earns its keep

Sealed agent records are not a filing cabinet. They feed your other defenses, such as telemetry and SIEM alerts. Send them to detection (identity telemetry and SIEM) so a burst of odd tool calls raises an alert. Send them to the agent registry too. Then operators like Zara can see a rogue agent and use the kill switch. After an incident, the trail rebuilds the story. When an auditor asks, it proves you follow the rules.