AI agent audit logs, done properly

When an AI agent does something wrong, or something a customer or regulator asks about later, the only thing that answers the question is the log. Most agent logs are not built for that moment. They record too little, they cannot attribute an action to a specific agent, and they can be edited after the fact. Here is what a log needs to be actual evidence.

What to record

Every model call and every action the agent takes should record, at minimum: a timestamp, the agent identity that acted, the run or job it belonged to, the model and provider, the tokens in and out, the cost, the latency, and the outcome. Actions that were held for approval should record who decided and when. Requests that were blocked should record why.

Give each agent an identity

The most common failure is agents sharing one service account. When every agent authenticates as the same key, the log cannot tell you which agent did what, and the audit trail is worthless. Each agent needs its own named identity so that every line in the log points at a specific actor, and in a chain of agents, at the specific agent in the chain.

Keep them long enough

Under the EU AI Act, deployers of high risk systems must keep logs for at least six months and produce them on request. Other regimes and customer contracts often ask for more. The practical rule: retention has to be a decision you made on purpose, with an owner, not an accident of how long your log store happens to hold data.

Make them tamper evident

A log that anyone with database access can quietly edit is not evidence, it is a note. The fix is a hash chain: each event stores a hash computed from the previous event's hash plus its own fields. Edit or delete any record and every hash after it stops matching, so the tampering is detectable and the point of the break is provable. This is the difference between saying you kept records and being able to show they were not altered.