An audit trail for AI agents
An application log says the request went through. An audit trail says on what basis it was allowed to. An inspection asks about the second one.
What separates an audit trail from a log?
A log describes a technical event. An audit trail adds the basis for the decision, the identity of whoever approved it, and the evidence that accompanied it.
Without those three, why did the agent do this stays unanswered even when the log is complete.
Why append-only?
Because the evidential value of a record you can overwrite equals your trust in whoever holds the database credentials. Chaining entries by hash does not make change impossible; it makes change visible.
That is enough for the goal that matters operationally: nobody can quietly remove one inconvenient decision.
What belongs in a single entry?
Enough to reconstruct the decision without asking anyone to remember it.
- The action and its inputs.
- The policy rule that classified it, and the resulting tier.
- The approver: the machine, or a named person.
- The evidence: test results, verification, the content prepared for sending.
- The hash of the previous entry.
What does an audit trail not do?
It does not make a company compliant with anything and it is not a certification. It also does not protect against an untruth written at the start: the chain will faithfully preserve a wrong basis for a decision.
It is operational tooling, not a legal shield.