Audit Trail
An audit trail is a chronological record of system activities that provides documentary evidence of the sequence of actions taken by users, agents, or systems. In agent governance, an audit trail captures every tool call, policy evaluation, authorization decision, and data access event for compliance and forensic purposes.
Why It Matters
Audit trails serve three functions: compliance evidence (proving to auditors that controls are in place), incident investigation (reconstructing what happened during a security event), and policy tuning (analyzing patterns to improve governance rules).
For AI agents, the audit trail must capture more than traditional system logs. Each entry should record who (the user and the agent), what (the specific tool call and action type), where (which downstream app and resource), why (which policy fired and what decision it produced), and when (timestamp with session context).
Immutable audit trails (append-only, tamper-evident) are preferred for compliance. If an agent's audit log can be modified after the fact, it loses its evidentiary value. SIEM-aligned vocabulary (audit events, not log entries) signals maturity to security teams.