Glossary
What is an agent audit trail?
An agent audit trail is the durable, attributable record of what an AI agent did: which actions it took, on what data, under which policy, in what sequence, and with what outcome.
§ 01 Definition
The record an examiner reviews.
An agent audit trail is the durable, attributable record of what an AI agent did: which actions it took, on what data, under which policy, in what sequence, and with what outcome. It is what an examiner reviews after the fact when the work the agent did is consequential. The difference between an audit trail and ordinary logging is durability and attribution: a log can be partial or rewritten; an audit trail has to survive the engagement and identify the actor.
An agent audit trail is not the same thing as the harness's working state. The harness coordinates the agents in flight; its records of in-flight coordination are ephemeral. The audit trail is what lives one layer below the harness, in a substrate that outlives any single engagement, retains every attributed action, and produces the record on demand.
§ 02 Questions
The agent audit trail, answered.
How is an agent audit trail different from a system log?
A system log records events; an audit trail records attributed actions against policy. The difference is what survives an examination. A log is often rolling, partial, and operator-managed. An audit trail is durable, retained on a defined schedule, and attributed to the actor that produced the action, including non-human actors.
Which regulatory frames assume an agent audit trail exists?
SR 26-2 directs banks to broader risk governance for agentic AI, which assumes an attributable record of what the agent did. NERC CIP expects an attributable trail for actions on Bulk Electric System assets. The EU AI Act requires record-keeping and human-oversight evidence for high-risk classifications. DORA requires recoverable and attributable ICT operations, which includes AI agents in financial workflows. NIST AI RMF 1.0 does not mandate it but evidences its Manage function through exactly this kind of record.
§ 03 Related
Where the term lives.
Regulatory frames