AgentKey · Observability

AI Agent Audit Logs

AI agent audit logs are the tamper-evident records of every action an AI agent took, every authorization decision made on its behalf, and the order in which events occurred, structured so an auditor can replay and verify a session without trusting the system that produced it.

By AgentKey · Last updated 2026-09-01

More than logging

A log says something happened. An audit trail says something happened, in this order, and proves it has not been changed. For agents that take real actions, the second is what an auditor or a customer needs.

A hash-chained record

Each event carries a hash of the event before it and its own leaf hash.
Events are append-only: nothing is deleted or rewritten.
A session can use a linear chain or a Merkle root.
Missing events become visible gap markers, not silent holes.
Verification recomputes the root from raw events and compares it to the stored one.

Coverage, not just events

A complete trail also records coverage: did every execution have a matching authorization? An action taken without authorization is a finding even if it succeeded. Surfacing those gaps turns an audit log into a security signal.

Where AgentKey fits

AgentKey writes every authorization and execution as an EvidenceEvent on a per-session hash chain. verify_session recomputes the chain from raw events; export_compliance produces a bundle for auditors. Coverage gaps surface as findings.

Frequently asked questions

How can AI-agent actions be audited?

Record every authorization and execution to an append-only, hash-chained trail, mark gaps where an action had no matching authorization, and let anyone recompute the hashes from the raw events to confirm the record is intact.

What makes an audit trail tamper-evident?

Each event hashes the one before it. Changing or removing an event changes every hash after it, so the stored root and a recomputed root no longer match. Verification detects the change without trusting the system.