Enough to reconstruct every decision without replaying the model. For each conversation, log who the customer was and how they were verified, what they asked, the sources used, every verdict and the bound that decided it, every action and its result, what was disclosed, any handover, and the agent version in force. Keep no more personal data than that.
Why log more than the transcript?
A transcript shows what was said. It does not show why. If a customer complains that the agent refused a refund, the transcript shows the refusal. The log should show that the refund was above the customer's limit of 50, that the agent's certificate for refunds was current, which policy version applied, and that the draft was held for a named person. Without that, you are guessing at the agent's reasons after the fact, and a re-run of the model today may not behave as it did then.
Logs also serve people beyond the complaint handler: the person who picks up a handover, the quality reviewer, the auditor and, in some cases, the regulator. Under the EU AI Act, Article 12 requires automatic logging for high-risk AI systems, and many firms apply the same discipline more widely.
What goes in the log?
| Field | Why it matters |
|---|---|
| Customer reference and verification method and result | Shows the agent knew who it was talking to before discussing the account |
| Channel, start and end time | Context for every other field |
| AI disclosure given | Shows customers were told they were dealing with an AI |
| Recording notice and any consent | Shows what the customer was told and agreed to |
| Contact reason | Groups conversations for analysis |
| Sources used for each answer, with versions | Lets you check a disputed answer against the text in force |
| Each verdict: allowed, held, refused, withheld | The heart of the record |
| The bound that decided each verdict | Distinguishes the agent's limit from policy from a platform rule |
| Actions taken and the system's response | Shows what actually happened, not just what was said |
| Handover: when, to whom, with what note | Lets the receiving person and later reviewers see the hand-off |
| Agent version: brief, sources, certificate | Ties behaviour to the configuration at the time |
| Model and usage | Feeds cost tracking and incident review |
Disclosure and consent are covered in whether a support agent should ask for consent before recording a conversation. The handover fields line up with how a support agent should hand a conversation to a person.
What should not go in the log?
Card numbers, full bank details, passwords and one-time codes should never reach the agent, so they should never reach the log. Special category data, such as health details a customer mentions, should be handled under your data protection rules and minimised. Internal reasoning text from the model is rarely useful and can contain personal data; the verdicts and sources are the record that matters.
Logs are personal data, so they need a retention period, access controls and a place in your records of processing. Decide retention per purpose before launch.
An illustrative example
Take a subscription service. A customer complains that the chat agent refused to cancel their plan without a fee, while a friend was told the fee would be waived.
The support lead opens the log. Verification passed by app approval. The contact reason was cancellation. The agent used policy version 3.1, which charged an early-exit fee. The verdict was allowed for cancellation with the fee; the waiver was refused, decided by the customer's limit: no waivers for plans under six months. The friend's conversation, a week later, used policy 3.2, which had removed the fee. Both agents behaved correctly against the policy in force.
The lead can explain this to the customer precisely and decide, as a person, whether to waive the fee given the timing. Without the version field, the two conversations would look inconsistent and the agent would be blamed.
What controls keep the log trustworthy?
- Append-only storage. Entries cannot be edited or deleted outside the retention schedule.
- Written at the moment of action, not reconstructed later.
- Version fields required. A conversation cannot start without the agent version recorded.
- Change history alongside. Changes to the agent's brief, sources and limits are logged separately, so the version in each record can be traced; the format is in the AI agent change log template.
- Cost fields that feed tracking the cost of each AI agent.
Where Pryme fits
In Pryme, every verdict is filed in an append-only record with the bound that decided it, the sources and their provenance class, and the certificate in force. Any decision can be reconstructed without re-running the model. More is in the AI support agent that knows when to say no.
Questions people ask
Can customers see the log?
They can ask for their personal data, which includes much of it. Make sure logs are retrievable per customer for access requests.
How long should logs be kept?
As long as your purposes and obligations require, and no longer. Complaint windows and regulatory duties usually set the minimum.
Should the log record the customer's sentiment?
A simple tag can help analysis, but it is an inference about a person. Use it carefully and do not let it drive decisions alone.