What is an audit trail?

An audit trail is a time-ordered record of who did what, when, and to which data, complete enough that someone who was not there can reconstruct what happened. In finance it links each reported figure to its transactions. Once AI agents act, it must also record why each action was permitted.

Why does an audit trail matter once agents act?

Traditional audit trails assume a person is behind each action, and that the person can be asked to explain it. With agents, the actor is a system that cannot be interviewed in any meaningful way. The trail itself has to carry the explanation: what the agent was asked, what it saw, what it proposed, which limits applied and who, if anyone, approved it.

A trail that only says "agent updated record at 14:02" is a log, not an audit trail for an agent. Auditors and supervisors will want to know whether the update should have happened. That is the argument in the audit trail should explain the decision, not just log it, and it follows from agent governance is a bound, not a model.

What should an agent's audit trail contain?

• The request: what prompted the action, and from whom.
• The sources: the facts the agent used, each with where it came from.
• The proposal: what the agent intended to do.
• The verdict: allowed, held, refused or withheld, with the bound that decided.
• The approval: for held actions, the named person, their decision and the time.
• The effect: what changed in which system.
• Integrity: protection against later editing, ideally append-only and tamper-evident.

How to use the trail in practice is covered in how do you audit what an AI agent did?

What does that look like in an example?

A payroll bureau's agent prepares monthly pay files for client companies. An employee at one client complains that their overtime was not paid. The audit trail shows the agent received the timesheet export, that the overtime lines arrived with a code the agent was not configured to recognise, that it flagged them as unmatched and held the file, and that a bureau administrator approved the file without resolving the flag. The fault is clear in minutes: a missed review, not a hidden error by the agent. Without the verdict and approval steps in the trail, the bureau would only have known the file was sent.

How is an audit trail different from a system log?

A system log is written for engineers. It records technical events, such as calls, errors and timings. An audit trail is written for reviewers. It records business events in a form a person can follow, it is retained for as long as the records it supports, and it is protected from change. A system can produce detailed logs and still lack an audit trail, because nobody can use the logs to answer "who decided this, and on what basis?"

How do you prepare an audit trail for an audit?

Agree the scope with the auditor, export the relevant records with their integrity evidence, and explain the structure before handing it over. Internal audit often needs its own independent access rather than extracts prepared by the team being audited, a point made in internal audit needs its own view of agent decisions. The process is covered in how to prepare AI agents for an audit and how to brief internal audit on how AI agents are governed.