Agent Audit Log

The questions an audit log should answer

For each consequential action, a reviewer should be able to identify the initiating person or service, the agent session, the requested operation, its target, the applicable authorization, and its result. Useful correlation fields connect the event to a task, repository revision, tool invocation, and eventual pull request.

Keep the action request separate from the action result. A model asking to delete a file does not establish that the tool deleted it. Similarly, an approval request does not establish that a person approved the operation. OWASP's logging guidance emphasizes attributable event records and protecting logs from unauthorized access and alteration. OWASP Logging Cheat Sheet.

A reviewable sequence

In a hypothetical migration, session run-42 proposes changing a database schema. The runtime records a pending approval for that operation. A reviewer approves a migration in the staging environment only. The execution tool then reports a staging transaction identifier and a successful result.

Later, the agent attempts the same operation against production. The runtime rejects it because that target is outside the approval. Recording the rejection matters: a final summary that says only "migration completed" would conceal the difference between the two environments.

A useful investigation can follow those records from the original task to the staging change and the rejected production attempt. The reviewer should not have to infer the approval from conversational phrasing or assume that every action in a session inherited the same permission.

Audit logs, traces, and transcripts

A transcript preserves conversational content. A trace helps explain timing and relationships between operations. An audit log is designed to establish an attributable history. These records may share identifiers, but they serve different purposes and can have different access and retention requirements.

OpenTelemetry defines attributes for agent and tool operations, while warning that messages and tool results may contain sensitive information. A common telemetry vocabulary helps join records; it does not make every exported trace a complete audit trail. OpenTelemetry Gen AI attributes.

Limits and data minimization

Do not collect passwords, access tokens, or complete source files merely because the logging system can store them. Often an operation type, resource identifier, content hash, and outcome provide enough investigative value. Where sensitive content is necessary, give it narrower access and an explicit retention policy.

Auditability also depends on completeness. Sampled traces may omit the action under investigation; local logs may disappear when a workspace is deleted. Test failure paths and record when collection itself fails. Logs can support accountability, but they cannot prove an unrecorded event never occurred or explain an agent's private internal reasoning. Use code generation attribution to describe the strength of the connection between recorded agent activity and the code that eventually shipped.