SKIP TO CONTENT
AI AGENTS6 minAgents in Production / Ep. 8 · Stage 8-1

AI Agent Audit Trail: A 14-Field Record for Auditors

An auditor points at one number your AI agent produced and asks how it got there. Could you show them?

XIN

IN 30 SECONDS

An audit record for an AI agent is an entry written at the moment the agent acts, so someone outside your team can rebuild one specific output later. This stage shows the 14-field record I propose: my design, not a standard.

KEY TAKEAWAYS · 3

  • An auditor asks how one specific number was produced, who answered for it, and whether the log was edited since.
  • I propose 14 fields, one record per agent action: my design, not a standard.
  • Write the evidence before the answer exists, and check the hash chain against a signed checkpoint the writer can’t reach.
On this page

The question that stalls an AI pilot

IN SHORT A pilot, the trial run before full rollout, stalls when nobody can show how one number was produced, even if the model was right.

Picture an illustrative review. An auditor picks one line from a report your agent produced, points at a number and asks how it got there.

Your team’s overall score doesn’t help. The auditor wants the evidence behind this one output. If the decision context wasn’t kept, rebuilding it may be impossible.

HOW A PILOT DIES

What the team can show

An aggregate accuracy score and some sampled traces, kept for only a share of runs. Six weeks after the run, nothing rebuilds this one number. The project quietly stops.

What the auditor asks for

The documents used for this output, the checks that ran, the decision, who signed off, and proof the record hasn’t changed since.
Illustrative: this scenario explains the design below, it isn’t a claim that a particular client audit failed. Nothing here is a model failure: the break is a record-keeping problem.

Observability, the traces and dashboards a team uses to debug, won’t save you here. It’s built for the team that runs the system. An Audit record One entry per agent action, written when the action happens, that can be added to but never changed. See the glossary is built for someone who doesn’t trust you, and that difference shapes every field.

Coming up next: So what makes a record convincing to an outsider?

Words to know

IN SHORT A record convinces an auditor only if it was written at the time, can’t be quietly changed, and points at the exact sources used.

WORDS TO KNOW

Audit record
One entry per agent action, written when the action happens, that can be added to but never changed.
Evidence
The exact part of each source document the agent actually used, with its page and position.
Hash chain
Each record includes the hash of the record before it: a short fingerprint that, in practice, changes if one byte changes.
Signed checkpoint
A signed copy of the latest hash, kept where the person or system writing the log can’t change it.

In this design, the record is append-only: you add entries, never change old ones. A correction is a new entry that points at the old one.

Each entry stores the Evidence The exact part of each source document the agent actually used, with its page and position. See the glossary it used, with the hash of each document. Each entry also carries the hash of the entry before it: that’s a Hash chain Each record includes the hash of the record before it: a short fingerprint that, in practice, changes if one byte changes. See the glossary, and changing one row breaks every hash after it.

ADAM says: Think of a lab notebook with bound, numbered pages in ink: a torn-out page shows. Where it breaks: a digital log can be rebuilt end to end, every hash recomputed.

So check the chain against a Signed checkpoint A signed copy of the latest hash, kept where the person or system writing the log can’t change it. See the glossary kept under separate protection. Recomputing an unsigned chain alone doesn’t prove nobody replaced it.

Coming up next: What goes into each record, then?

The record: 14 fields in three groups

IN SHORT I propose one record per agent action, with 14 fields in three groups.

14
FIELDS IN THE RECORD
one record per agent action

My proposed design, not a standard.

One per action, because an action is what an auditor points at. The fields answer the usual questions for rebuilding an output. They aren’t a log of what a client auditor asked.

IN PLAIN WORDS

The EU AI Act is the European Union’s law on AI. Its Article 6 sets criteria for classing some AI systems as high-risk. The Act puts extra requirements on those systems and duties on the companies that provide or use them.

Article 12, record-keeping, says a high-risk system must technically allow its events to be recorded automatically, over its whole life. It says the logging must exist. It doesn’t give you a schema, so this one is mine.

These high-risk duties apply from 2 December 2027 for Annex III systems. For Annex I systems, the date is 2 August 2028 (Regulation (EU) 2026/1744, Commission timeline). This is an engineering write-up from an AI and smart-contract engineer: each legal rule here links to its source, so you can check it.

STEP BY STEP

Layered stack diagram: 3 layers, top to bottomLayered stack diagram: 3 layers, top to bottom. Layer 1, WHAT RAN (8): recordId, occurredAt, actor, agentId, taskRef, modelId, promptVersion, inputDigest. Layer 2, WHAT IT CONCLUDED (4): evidence, checks, decision, humanReview. Layer 3, HOW LONG, HOW TRUSTED (2): retentionClass, chain.WHAT RAN (8)recordIdoccurredAtactoragentIdtaskRefmodelIdpromptVersioninputDigestWHAT IT CONCLUDED (4)evidencechecksdecisionhumanReviewHOW LONG, HOW TRUSTED (2)retentionClasschain

Step 1. What ran. Eight fields say what ran: when, which agent, model, prompt and input. An input’s hash can’t rebuild it, so keep an authorized reference when it must be reconstructed.

Pick a step to see it move
  1. What ran Eight fields say what ran: when, which agent, model, prompt and input. An input’s hash can’t rebuild it, so keep an authorized reference when it must be reconstructed.
  2. What it concluded Four fields hold the evidence, every check with its result, the decision and any human review.
  3. How long, how trusted Two fields name the retention rule and chain the record to the one before it.
Fourteen fields, one record per agent action, append-only. My proposed design, not a standard.

One field matters most, and it’s about order. The evidence is written when it’s found, before any answer exists. Sources found later can still count, if labelled as later corroboration.

ITEM GET

Evidence first

A citation attached afterwards proves the agent could find a source, not that it used one.

FAQ

No. Observability serves the team, and depending on its setup, its traces may be sampled, expire, or be edited or backfilled. An audit record is complete for the actions in scope, kept for the period the law sets and tamper-evident. You can build one on the other, but a dashboard isn’t one by default.

STAGE CLEAR

What you now know

  • Why an average score can’t answer an auditor’s question about one number.
  • What makes a record convincing, and how the 14 proposed fields are grouped.

Check yourself

Tap or click a question to see the answer.

Illustrative case: an hour after each answer, a script searches the document store and attaches the best-matching source. Is that the agent’s evidence?

No. It shows a plausible source exists, not that the agent used it. It can be logged as later corroboration, labelled as such. The evidence is what was written at retrieval time.

Next stage:How does one agent decision turn into records an auditor can check?6 min
Adam Boudjemaa
Adam Boudjemaa

Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.

Have a project to ship or a role to fill?

Discuss your project or role
LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.