AI agents are no longer demos. They are issuing refunds, approving purchase orders, deploying code, sending emails on your behalf, and moving real money. The systems that built up around human operators (approval queues, signed-off changes, tamper-evident logs, four-eyes controls) assumed a human at the keyboard. Agents do not fit that assumption, and most teams have not yet built the audit story for them.
The question every regulator will ask
Pick any agent your team has shipped in the last twelve months and ask: who authorised the action it just took? If the answer is "the agent decided", the next question is the one your board, your insurer, and your auditor will all ask in the same words: prove it. Show me the inputs, the prompt, the model version, the tools it called, the data it touched, and the response it returned to the user. Show me the chain that says nothing has been changed since.
For a human operator, that chain is well understood. The application logs the request. SSO logs the session. The database logs the row change. SIEM correlates them. Years of practice tell the auditor exactly which artefacts to ask for. None of that applies cleanly to a non-deterministic system that calls tools on your behalf based on a prompt you didn't write.
Why ordinary application logs are not enough
Three things break in a typical logging stack the moment an agent is in the loop:
- Logs are write-anywhere, mutable. A developer or a compromised process can edit, drop, or rewrite an entry. That is fine when the entry is a bug report; it is not fine when the entry is "the agent moved $40,000 to vendor X".
- Logs are unsigned. Nothing binds a log line to the process that produced it. If you suspect the log has been tampered with, you have no cryptographic recourse.
- Logs are scattered. The prompt is in the LLM provider's dashboard. The tool call is in the framework. The downstream effect is in your application database. The user- visible response is in the chat product. Reassembling the chain after the fact is detective work, not evidence.
What an audit trail for agents looks like
The shape is well established by other regulated industries. We adapted it for AI agents:
- Signed at the source. Every event the agent emits is signed locally with an Ed25519 key the customer holds. Wytness only stores the public key. We cannot forge an event in your name.
- Hash-chained. Each event includes the hash of the previous one. Tampering with any event breaks the chain forward of it, and the break is visible.
- Append-only archive. Events land in append-only storage with a defined retention schedule and a soft-delete recovery window. Customer-hosted storage can opt into per-bucket blob immutability policies for stronger guarantees.
- Reconciled. Three-way reconciliation between ingest counters, the query store, and the durable archive surfaces gaps, not just tamper.
- Queryable. Compliance and security teams can answer "what did this agent do last Tuesday at 3:14am" without running a forensic project.
The launch checklist
If you are about to put an agent in front of customers, partners, or production systems, the bar is roughly this:
- You can produce a complete record of every action the agent took, with inputs, outputs, and tool calls.
- Each record is cryptographically signed by the agent's environment, not by the platform.
- Records are append-only and any modification or deletion is independently detectable through cryptographic chain verification.
- You retain those records for at least the period your jurisdiction's strictest applicable regime requires.
- You can produce a compliance-ready report on demand without engineering time.
That is the audit trail AI agents need. It is what we built Wytness to deliver. See how it works for the technical detail, or pricing if you are sizing it up for a deployment.