Glossary
What is audit-of-action?
Audit-of-action is the substrate-produced, attributed, tamper-evident record of what an AI agent did. Access control decides what an agent may do; audit-of-action records what the agent actually did.
§ 01 Definition
What an agent did, not what permissions allowed.
Actions are bound to the agent that performed them, their inputs and outcome, and a hash-chained entry that an auditor can verify.
A regulator asking whether an AI agent may have acted on protected data is asking about access control. A regulator asking what your AI agent did during a specific time period is asking about audit-of-action.
§ 02 Questions
Audit-of-action, answered.
How is audit-of-action different from access control?
Access control produces a permission before the action. Audit-of-action produces evidence after the action.
What does the substrate produce that a log-shipping pipeline does not?
Attribution at the moment of action. A log-shipping pipeline stitches events together after the fact and asks the operator to trust that the stitching preserved the truth. See what is a tamper-evident audit log for the integrity property.
Which regulatory frames expect audit-of-action?
SR 26-2’s compliance posture presupposes an interrogable record for agentic AI excluded from model-risk scope. For high-risk AI systems under Annex III, the EU AI Act Article 12 record-keeping obligation calls for the kind of evidence audit-of-action produces.
§ 03 Related
Where the term lives.
Regulatory frames