An audit trail for AI agents
An application log says the request went through. An audit trail says on what basis it was allowed to. An inspection asks about the second one.
What separates an audit trail from a log?
A log describes a technical event. An audit trail adds the basis for the decision, the identity of whoever approved it, and the evidence that accompanied it.
Without those three, why did the agent do this stays unanswered even when the log is complete.
Why append-only?
Linking records by hash can reveal a mismatch against a preserved, trusted chain. Before deployment, agree who protects the records and where the final hash is independently preserved as a reference.
Detection depends on a trusted reference. Someone who controls both records and hashes can truncate the history or recompute the whole chain. A successful check against the current chain alone cannot prove the earlier record was untouched.
What belongs in a single entry?
Enough to reconstruct the decision without asking anyone to remember it.
- The action and its inputs.
- The policy rule that classified it, and the resulting tier.
- The approver: the machine, or a named person.
- The evidence: test results, verification, the content prepared for sending.
- The hash of the previous entry.
What does an audit trail not do?
It does not make a company compliant with anything and it is not a certification. It also does not protect against an untruth written at the start: the chain will faithfully preserve a wrong basis for a decision.
It is operational tooling, not a legal shield.