Audit trail

What each audit record holds

NIST SP 800-53 Rev. 5, control AU-3, lists six items for each audit record. Here they are for an AI agent.

AU-3 item	Example for an AI agent
Type of event	Tool call, prompt, approval, model call
When	Time of the call
Where	Host, server or repository
Source	The agent, its session, the control software
Outcome	Success or no success, error type
Identity	The user who gave the task, the agent identity, the approver

NIST control AU-10 asks for proof that an individual, or a process for that individual, did a step.

How an audit trail works

An audit trail has four parts.

1. Capture. The control software around the model writes a record for each event.
2. Protection. NIST AU-9 asks for protection of audit data from access, modification and deletion that is not approved. AU-9(3) adds cryptographic integrity protection.
3. Retention. The EU AI Act sets a minimum of six months for logs of high-risk AI systems. Other law can change it.
4. Inspection. A person or a tool reads the audit trail after an incident.

Why an audit trail is necessary for AI agents

An AI agent uses tools in live systems. The audit trail shows which steps it did.

• Damage limit. OWASP LLM06:2025 lists logs and monitors of agent work as a control for excessive agency. OWASP says that this control does not prevent the risk. The logs show where bad steps occur, so the team can respond.
• Accountability. A record with identities shows if a person or the agent started a step, and who gave approval.
• Law. Article 12 of the EU AI Act asks for automatic logs for the full life of a high-risk AI system.

In practice

Some agent tools export audit events as OpenTelemetry data. Anthropic documents these OpenTelemetry events for Claude Code, a coding agent:

• claude_code.user_prompt: the user gave a prompt.
• claude_code.tool_decision: a permission decision, accept or reject.
• claude_code.tool_result: a tool completed, with name, success and duration.
• claude_code.api_request: Claude Code sent a request to the model.

That default is a privacy selection. Prompts and tool inputs can contain secrets and personal data. Union data protection law can also change the retention rule of the EU AI Act. A human in the loop approval also needs a record to be useful after the event. Thus, make a decision about what to record, where to keep it, and who can read it.

Limits of an audit trail

• Sequence, not cause. Ojewale and colleagues say audit trails give “chronological and structural traceability but not causal explanation”. A person must judge why the agent did a step.
• Volume. The same paper says that continuous inference, fine-tuning and monitoring “can generate millions of records to process”.
• Developer logs are not sufficient. The same paper says MLOps tools “are usually oriented toward developer needs, not governance”.- The audit trail is a target. An attacker who controls the agent host can try to erase records. Thus, AU-9 asks for protection and alerts. Keep the audit storage away from the agent.

Questions and answers

What is the difference between an audit trail and a log?

A log is a record of events. NIST defines an audit trail as a chronological record that shows the full sequence of steps around a security-relevant event. NIST control AU-3 asks for six items in each audit record. A separate control, AU-9, asks for protection of audit data from modification and deletion.

How long must AI system logs be kept under the EU AI Act?

Articles 19(1) and 26(6) of the EU AI Act set the rule. Providers and deployers of high-risk AI systems keep their automatic logs for a minimum of six months. The duty starts on the application dates the Act gives for each type of high-risk system. Other Union or national law, for example data protection law, can set a different period.

What must an audit trail for an AI agent record?

Record each prompt, each tool call, each approval or reject decision of a person, and each result. NIST control AU-3 asks for six items in each record. These are type, when, where, source, outcome and the identities, for example of the user and the agent.