Agent Audit Trail: The IETF's New Standard for Logging AI That Acts on Its Own

A postmark for every action

When an AI agent books a meeting, changes an order or queries a database, someone has to know what it did and when. The IETF's draft standard Agent Audit Trail (AAT) is a logging format designed for exactly that: systems that act autonomously, without a human clicking a button each time.

The clever bit is the way it prevents quiet edits. Each log record contains a hash of the previous one, so the records form a chain. Change one and the chain breaks, like altering a line in a sealed letter: you can do it, but the postmark won't match anymore.

The draft was published in January 2025 and is in the early stages of standardisation. It's worth watching, because the AI Act's logging requirements apply to high-risk systems from December 2027, and autonomous agents acting on people's behalf are likely to count.

What the standard specifies

Agent Audit Trail defines how to log what an AI agent does when it uses tools: which tool it called, what input it gave, what output it got, and when. Each record is human-readable JSON and includes a hash of the previous record ^[1].

The hash chaining means you can check the whole log by following the chain from the first record to the last. If someone changes a record in the middle, the hashes stop matching. It's a local check, done by anyone with the log, not a lookup against a central registry.

The standard also covers logging instructions given to the agent (the prompt or task), the agent's reasoning and the final outcome. That matters when you need to show not just what the agent did, but why it did it.

How it fits the AI Act

Article 12 of the AI Act says high-risk AI systems must technically allow for the automatic recording of events over their lifetime ^[2]. It lists what to log: input data, people the system interacted with and identified risks. It doesn't specify a format, so standards like AAT may end up defining what compliance looks like in practice.

For Annex III high-risk systems, Article 12 applies from 2 December 2027 ^[2]. An autonomous agent making decisions about people—say, processing loan applications or scheduling health appointments—would likely fall under that heading.

The catch is that Article 12 is about logging events, not about protecting the logs. AAT's hash chaining makes tampering visible, but the AI Act itself doesn't require tamper resistance. That gap leaves room for interpretation: a log you can quietly edit might technically meet the rule, but whether it would hold up as evidence is another question.

What AAT does and doesn't do

The standard gives you a structured way to record what an agent did, in a format both people and machines can read. The hash chain shows whether the log has been tampered with since it was written.

What it doesn't do is prevent deletion. You can still delete the whole log, or stop logging altogether. It also doesn't prove the log is complete—an agent could skip recording certain actions—and it doesn't time-stamp the records with an independent source. The time in each record is the time the system says it is.

For high-risk systems, where logs must be kept for at least six months ^[3], that means AAT on its own isn't enough. You still need access control, monitoring, backups and a way to show the log wasn't selectively edited by deleting inconvenient bits and recomputing the chain.

Sealing the log as you write it

That's where a digital witness comes in. Sealing each log record, or each batch of records, as it's written means any change shows up, even if it's made by someone with administrator rights and even if the chain is recomputed.

Here, the thing to seal is each log record as AAT writes it: the instruction reference, the tool call, the input, the output, the hash and the timestamp. Sealing takes a fingerprint, not the log content, so the log itself never leaves your systems. WitniumChain gives you a witness ID for each sealed record. If the log is questioned months later, anyone you share it with can recalculate the fingerprint and check that it matches the sealed one.

What that shows is that the record existed at that time, unchanged since. What it doesn't show is that the log is complete, that the agent's action was correct or that the reasoning was sound. Those are different questions, and no logging format answers them on its own.

The MCP server is the short route if your agent already speaks Model Context Protocol. For other setups, the REST API or SDK fits into your logging pipeline. The first 2,000 witnesses a month are free.

How it would work

1. Your agent performs an action and writes an AAT log record.
2. Your system seals the record's fingerprint immediately.
3. Months later, if the log is questioned, you recalculate the fingerprint and check it against the sealed one. Change a single character in the log and the fingerprints won't match.

What this means for you

If you're building or deploying AI agents, start by asking whether the agent counts as high-risk under the AI Act. If it makes decisions about people, it probably does, and Article 12 will apply from December 2027.

Then ask how you'd show what the agent did on a given day, if someone questions it. AAT is a format, not a complete answer. You still need to decide how you protect the logs, who can read them, and how long you keep them.

Finally, think about the chain of evidence. The log is what your system says happened. A digital witness per record is what proves the log hasn't changed. Neither replaces the other.

What to watch

The AAT draft is open for comment and likely to evolve. The IETF process is slow and thorough, so expect several revisions before it becomes a standard.

Meanwhile, 2 December 2027 is the date Annex III high-risk requirements, including Article 12, apply ^[2]. That's less than two years, and logging architectures aren't quick to build. If you wait until the standard is final, you may be building under deadline pressure.

The draft is at datatracker.ietf.org. Worth a look if you work with autonomous AI.