# AI agent audit logs, done properly

When an AI agent does something wrong, or something a customer or regulator asks about later, the only thing that answers the question is the log. Most agent logs record too little, cannot attribute an action to a specific agent, and can be edited after the fact. Here is what a log needs to be actual evidence.

## What to record

Every model call and action should record: timestamp, the agent identity that acted, the run it belonged to, model and provider, tokens in and out, cost, latency, and outcome. Approvals should record who decided and when. Blocked requests should record why.

## Give each agent an identity

The most common failure is agents sharing one service account. When every agent authenticates as the same key, the log cannot tell you which agent did what. Each agent needs its own named identity so every log line points at a specific actor, and in a chain of agents, at the specific agent in the chain.

## Keep them long enough

Under the EU AI Act, deployers of high risk systems must keep logs for at least six months and produce them on request. Retention should be a deliberate decision with an owner, not an accident of how long your log store happens to hold data.

## Make them tamper evident

A log anyone with database access can quietly edit is a note, not evidence. Use a hash chain: each event stores a hash of the previous event's hash plus its own fields. Edit or delete any record and every hash after it stops matching, so tampering is detectable and the break point is provable.

Bridle logs your agents this way by default: named identities, full per call records, six month retention, and a verifiable tamper-evident hash chain, with an evidence pack export mapped to the EU AI Act articles a reviewer will ask about.

Related: [EU AI Act compliance](https://agentbridle.com/eu-ai-act.md) · contact@agentbridle.com