Most production systems have logs. Logs are not audit trails.
A log records what happened: timestamps, events, errors, system state. An audit trail records what happened, who caused it, why it was authorized, and what changed as a result. For a human operator, the distinction is between a server log and a compliance record. For an autonomous agent, the distinction is between observability and accountability.
In regulated industries — financial services, healthcare, legal, government — the audit trail is a compliance requirement. Agents that take actions on behalf of users or enterprises must be able to demonstrate what they did, what information they used, and what authorization they had. In unregulated industries, the audit trail is a trust requirement: enterprise customers will not deploy autonomous agents unless they can verify agent behavior after the fact.
What an Audit Trail Must Answer
An effective audit trail for an autonomous agent system must be able to answer six questions about any agent action:
What did the agent do? The specific action: which record was written, which message was sent, which API was called, which decision was made. Not a summary — the exact action.
When did it happen? Precise timestamp at the operation level, not the workflow level. The audit trail for a workflow that ran 47 tool calls needs timestamps for each tool call, not just the workflow start and end.
What information did the agent use to decide? The inputs to the decision: which data was retrieved, which documents were in context, which prior step outputs informed the current step. For LLM-based decisions, this is the prompt and the relevant context — not the full raw context window, but the information that was material to the decision.
What authorization did the agent have? Which permissions were in scope for this action. Which user's authorization was the agent acting under. Whether the action was within the scope of the original user request or was an autonomous extension of scope.
Was a human aware? Whether the action was reviewed by a human before execution, whether a human was notified after execution, or whether the action was fully autonomous with no human in the loop.
What was the outcome? Whether the action succeeded, failed, or was partially completed. What the downstream state looks like after the action. What can be verified independently.
Audit Trail vs. Operational Log
An operational log records system events for debugging and performance monitoring. It is optimized for engineers. It answers: what is happening, and why is the system slow or broken?
An audit trail records agent actions for accountability and compliance. It is optimized for auditors, compliance officers, and customers. It answers: what did the agent do on behalf of this customer, and was it appropriate?
These have different requirements:
Operational logs can be compressed, sampled, and aged out. High-volume, low-retention, structured for machine processing.
Audit trails must be complete (no sampling), durable (retained for the required compliance period — often 3–7 years in regulated industries), tamper-evident (immutable after write), and queryable by non-engineers (compliance teams need to investigate agent behavior without writing SQL).
Building one system to serve both purposes usually means compromising both. They should be designed separately.
The Minimal Audit Record
At minimum, each agent action should produce an audit record containing:
- Action ID (unique, immutable)
- Workflow ID and step ID (links to the trace)
- Timestamp (precise, UTC)
- Actor (which agent, which agent version, which user's authorization was used)
- Action type (tool call, model call, data write, message send, etc.)
- Target (which system, which record, which recipient)
- Authorization scope (what permissions were in effect)
- Inputs (what data was used)
- Outcome (success / failure / partial, and the resulting state change)
- Human oversight indicator (reviewed / notified / autonomous)
For regulated industries, extend this with: the specific regulatory basis for the action (if applicable), the data classification of any data accessed or modified, and the consent status of any customer whose data was involved.
Tamper Evidence
An audit trail that can be modified after the fact is not an audit trail. For compliance contexts, the audit record must be immutable: once written, it cannot be edited or deleted.
Implementation approaches:
Append-only storage: Use a storage system that enforces append-only semantics — object storage with versioning and deletion prevention, a write-once database, or a dedicated audit log service.
Cryptographic chaining: Each audit record includes a hash of the previous record. Modification of any record in the chain breaks the hash chain and is detectable. This is the approach used by blockchain ledgers and is also applicable without a full blockchain implementation.
Third-party attestation: In the highest-stakes compliance contexts, audit records are signed and submitted to an independent third party. This provides evidence that the audit trail existed at a given point in time and has not been modified since.
For most enterprise deployments, append-only storage with versioning is sufficient. Cryptographic chaining adds complexity without proportional benefit unless the threat model includes modification by a privileged insider.
The On-Premises Dimension
For regulated industries deploying agents on-premises with self-hosted models, the audit trail must be entirely within the enterprise perimeter. This means:
- Audit records are never sent to external logging services
- The model's inputs and outputs are logged to internal systems only
- The audit system itself is subject to the same access controls as the data it records
This is one of the reasons on-premises LLM deployment matters for regulated industries beyond data residency. The audit trail for a model call that processes a patient record or a legal document must stay inside the perimeter just as the model call itself must. A cloud-hosted LLM with a cloud-hosted audit trail does not satisfy this requirement regardless of contractual assurances.