AI Systems Atlas

S-19Audit Logs

/security/audit-logs

An append-only record of every tool call, its arguments, the approval decision and the actor — which agent, on whose behalf.

Step-by-step walkthrough7 steps
  1. A human, an agent and its tools all act. Every action is also an event.
  2. Each record names the actor — which agent, which subagent, on whose behalf — plus the call and its arguments.
  3. Approval decisions are events too — including every denial: who decided, on exactly what, and when.
  4. Tool results carry secrets — a bearer token in a response header.
  5. Redaction runs before the write, so the log never becomes the next place a key leaks.
  6. Records are appended, chained and never edited — not even by the agent they describe.
  7. That record is what makes forensics, replay of the tool calls and anomaly detection possible.
Key insight

A trace is for debugging a run; an audit log is tamper-evident and names who authorized what. You cannot investigate an incident, replay a bad run’s tool calls or spot a drifting agent from logs that name no actor and drop the denied calls.

Failure mode

Logging the secrets along with everything else. A complete, well-retained log with bearer tokens in it is the most valuable file in the building.

Further reading
RelatedPermission policiesCredential leakageTrajectory evalTracing an agent run

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →