What an audit log for AI agents should record (and why hash-chaining matters)

01Which fields should every agent action record?

Start from a baseline auditors already know. NIST SP 800-53 control AU-3 asks that audit records establish what type of event occurred, when, where, the source, the outcome, and the identity of the individuals, subjects or entities involved. For agents, the hard part is the last item: the log has to separate what a person did from what an agent did on that person's behalf, and say whether the agent's identity was verified or merely claimed.

Agents add a second requirement: the decision, not just the act. When a policy allows or refuses a tool call, the entry should name the rule that decided it, and when a human approved something, it should name the approver. That is what lets a reviewer answer why an action happened, not only that it did.

• Sequence number and UTC timestamp (AU-8 asks for time stamps in or tied to UTC).
• Actor type (human, agent, tool, code inside the sandbox) and a verified agent identity where one exists.
• Action and target: the stable name of what was done, and to which sandbox, file, tool or host.
• Outcome: allowed, refused or failed, with a short stable reason.
• The policy or rule that decided, and any human approvals used.
• For commands, the command line plus a SHA-256 of the exact arguments; for network calls, host, port, method and path.
• Session or run ID tying related entries together, and the model in use.

02What should an agent audit log leave out?

Logs get forwarded to SIEMs, copied into tickets and kept for years, so whatever lands in them spreads. Keep out API keys, tokens and placeholders, environment variables, query strings and request bodies, which is where keys and personal data tend to travel. Redact credential-shaped values in command lines, and treat that redaction as best effort.

For tool arguments, results and prompts, record a digest instead of the content. A SHA-256 digest lets someone who holds the original prove it is what was sent, without putting the content where everyone can read it. The trade-off is real: the log can then confirm what happened but cannot show it to you on its own. Decide which side of that line each field sits on before an incident, not during one.

03How does hash-chaining make tampering visible?

Each entry stores the hash of the previous entry and a hash of its own contents. Edit an entry and its own hash no longer matches. Delete one and the next entry points at nothing, and the sequence numbers show a gap. Every entry depends on every entry before it, so you cannot quietly rewrite the middle of history.

Two gaps remain. Cutting entries off the end leaves a perfectly valid, shorter chain, so you also need a separately recorded head, the latest sequence number and hash, kept where the attacker cannot simply rewrite it. And if the chain uses a keyed hash such as HMAC, anyone holding the key can also forge a valid chain, so signing entries with a private key lets an outside party verify with only the public half.

Crosby and Wallach's 2009 USENIX Security paper frames the threat precisely: the logger itself is untrusted and is kept honest by auditors who challenge it to prove that events are still present and that today's log is consistent with what was seen before. That only works if auditors actually check. Tamper-evident is not tamper-proof: someone with full control of the machine can rewrite and reseal a local log. The defence is to forward entries off the machine and pin the verification key through a separate channel, which matches NIST AU-9's call to protect audit information from unauthorised modification and deletion, its enhancement for cryptographic integrity protection, and its option to store records on a physically separate system.

04How long should agent audit logs be kept?

There is no single number. NIST AU-11 leaves the period to the organisation: long enough to support after-the-fact investigations and to meet regulatory and organisational retention requirements. In practice that is set by your slowest investigation, your contracts and the laws that apply to you.

The EU AI Act gives one concrete floor, with a narrow scope. For high-risk AI systems, Article 12 requires that the system technically allow automatic recording of events over its lifetime, with logging that supports identifying risks, post-market monitoring and monitoring of operation. Article 19 has providers keep those logs, to the extent they control them, for a period appropriate to the system's purpose and at least six months, and Article 26(6) sets the same floor for deployers, unless other Union or national law, particularly data protection law, provides otherwise. Most coding agents will not be high-risk systems under the Act, so check classification before assuming these articles apply.

Retention also needs pruning that does not break verification. If you delete old entries, seal them into an archive segment whose hash the live chain still references, so the remaining chain verifies and the archive can be checked on its own.

05What do auditors actually ask for?

A SOC 2 report evaluates controls against the AICPA's Trust Services Criteria, which cover security, availability, processing integrity, confidentiality and privacy. The criteria do not dictate a log format. What an auditor needs is evidence that your controls operated: that agent access was limited, that risky actions were approved, that anomalies were reviewed, and that the evidence itself was not altered.

That turns into a handful of practical requests. Show who or what performed a given change. Show the rule that allowed it and the person who approved it. Prove the records are complete and unaltered for the period. Show the records left the machine that produced them. Show the retention setting and that it was enforced. An agent log designed around those questions, with the fields above, a verifiable chain and an export a third party can check without trusting your systems, makes the conversation short. It does not by itself satisfy any framework; controls, people and process do that.