AI agent audit log

What it is

Application logs are for debugging. An audit log is evidence. For AI agents it answers the questions an operator, an auditor or a customer will ask after the fact: who did this, through which credential, in which system, when, what came back, what it cost, and what the agent was trying to do.

The MCP tools specification asks clients to log tool usage for audit. OWASP's agent cheat sheet says to log all agent decisions, tool calls and outcomes, and to keep audit trails for compliance and forensics. NIST SP 800-92 covers the general practice of security log management.

Why it matters

Agents act at machine speed across many systems. Without one record you cannot tell which agent changed a record, explain a vendor bill, or show an auditor that a payment was approved. Token passthrough makes it worse: the MCP security guidance notes that when a server forwards a client's token, downstream logs show the wrong identity.

How it works

A useful entry holds:

• the credential (which agent) and the connection (which account at the vendor);
• the action, with a hash of its inputs and output;
• the outcome, error code and cost;
• the time;
• the intent, one sentence from the agent saying why;
• any approval, with who decided.

The log should be written by the platform that executes calls, not by each client, and made tamper-evident.

Example

"Key triage-bot, connection Autotask production, service.ticket.create, succeeded, 1 upstream call, 09:14:07, intent: the customer reported the backup failure by email this morning."

Common pitfalls

• Logs only in the client. Each client logs differently, or not at all.
• Secrets and personal data in plain text. OWASP says to redact credentials and personal data from logs.
• No reason recorded. Without intent, a correct action and a manipulated one look the same.
• Mutable storage. A table anyone with database access can edit is not evidence.

How actionlake handles it

The actionlake server writes one ledger row per run, whatever client the agent used. Every do and ask call must include an intent. The row holds identifiers, input and output hashes, cost and outcome; request and response bodies are kept separately as run traces (secrets removed, sealed under the tenant's key) for your plan's window, then deleted. Rows are hash-chained and the chain head is sealed daily. The record of the action is permanent; the agent's intent text is cleared after 90 days, while hashes, ids, cost and outcome stay. Each run can be verified on its page in the console; the console's CSV export carries the table, not the hashes. See the trust page, and the guide audit logs for AI agents for the full checklist.