AI agent audit logs

The control gap

Ordinary application logs split identity, policy, approval, credentials, execution, and outcome across systems. Correlation by timestamp leaves gaps and cannot prove ordering or tampering.

Start the audit model at intent. The authorization record captures the proposed agent, verified identity provenance, delegated task, canonical tool, target resource, arguments, environment, idempotency key, matched rule, decision, reason, and policy version. Approval adds reviewer and expiry. Grant issuance and consumption add the temporary execution authority. Runtime events add endpoint and outcome.

Tamper evidence does not mean every endpoint fact is independently attested. Endram signs its decision receipts and each execution event, and every event includes the preceding event hash. Events contributed by a server-side adapter have stronger observation than caller-reported completion. The UI should expose missing chains and confidence rather than inventing a successful outcome when no completion arrives.

What good looks like

One evidence chain connects delegator, agent, task, request, decision, grant, execution start, and terminal outcome with signatures and previous-event hashes.

• Signed decision receipts
• Hash-linked execution events
• Verified identity provenance
• Success and failure outcomes

A production workflow

1. Record the authorization request
2. Attach approval and grant events
3. Record execution start
4. Sign the final provider outcome

Evidence to require

• Delegator-to-agent chain
• Policy and reason
• Grant scope and use
• Event hashes and signatures

Buyer checklist

• Can the product enforce a decision before the external tool executes?
• Can policy distinguish the agent, delegated user, tool, resource, and environment?
• Can reviewers see the exact requested action and approve it without broadening future access?
• Does every allow, deny, and approval retain the policy version and reason?