What an AI agent audit trail must record

Start with one execution identity and an explicit authority boundary

Assign a stable execution identifier before the first model call. Every planning step, retrieval, tool invocation, approval, retry, and final action should carry that identifier together with the tenant, requesting user or service, and the policy or role that authorized the run.

Identity alone is not enough. The record must distinguish what the user requested, what the agent proposed, what policy allowed, and what an external system actually accepted. This prevents a later review from treating a model suggestion as a completed business action.

• Actor, tenant, delegated role, and authentication context.
• Agent, model, prompt-template, policy, and tool-registry versions.
• Execution, parent execution, request, and external transaction identifiers.
• Timestamps, region, environment, and the service that emitted each event.

Capture decisions and tool calls at the execution boundary

A final transcript misses the most consequential step: the boundary where generated intent becomes executable input. For every tool call, record the selected tool and version, normalized arguments or a digest, policy checks, approval state, start and finish status, result or error digest, and any external object identifier.

Retries need their own attempt numbers and reason codes. Otherwise a reviewer cannot tell whether two payments, messages, or database changes were separate decisions or duplicate attempts after a timeout.

Minimize sensitive data without losing verifiability

Audit logging does not justify copying secrets, personal data, or full retrieved documents into a second system. Define field-level rules that retain identifiers and cryptographic digests while masking access tokens, credentials, regulated fields, and unnecessary model context.

The evidence schema should identify which redaction policy was applied. If authorized investigators may retrieve protected source data elsewhere, record the source reference and access decision rather than duplicating the data in the audit trail.

Prepare independent review and retention from the beginning

An audit trail should support filtered retrieval by tenant, execution, actor, tool, status, and time window. Exports need a documented schema, version, checksum, sequence information, and verifier instructions. Retention and deletion must cover indexes, exports, backups, and recoverable copies rather than only the primary event table.

NIST AI RMF materials emphasize measurement, documentation, histories, and independent review as part of governing AI risk. The exact control set still depends on the institution, applicable law, and the consequence of each agent action.