AI agents need audit trails, and here's what to log

The practical question

Agentic AI systems plan, choose tools and act on their own to reach a goal. That autonomy is also the challenge: when an agent changes an order, books a meeting or sends a message, someone later needs to know what it did, when and on whose instruction.

Akamai's governance framework for agentic AI sets out a practical answer ^[1]. It recommends capturing input prompts, the agent's execution plan, each tool call with its results, the data the agent accessed and the final output. Together, those make an audit trail that tells you what happened.

It's the same idea behind Article 12 of the AI Act, which says high-risk systems must technically allow for the automatic recording of events over their lifetime ^[2]. For Annex III systems, that applies from 2 December 2027. The law says what to log; it doesn't say how to protect the logs. Protecting them is still a good idea, for a simpler reason: one day someone will ask you to prove what your system did.

Why the logs matter

An agent acting in a customer account can trigger complaints, disputes and regulatory questions. If the agent made a mistake, the organisation needs to know what went wrong. If it didn't, the organisation needs to show that.

Say an agent changes a customer's delivery address and the customer says nobody asked it to. The question is what the agent was told to do, which tools it called and what the result was. If the log its operator can edit is the only record, the customer's screenshot is as good as yours.

Logs kept by the same people who could change them get questioned, particularly when there's money or liability at stake. The governance question is whether you can show later that a log is the one written at the time.

How a digital witness fits

Here, the thing to seal is each instruction, tool call and result as the agent acts. Sealing takes a fingerprint of the record, not the record itself, so the log stays in your systems. If it's questioned later, anyone you share the record with can check that it's exactly what was written at the time.

Say a customer claims an agent sent an email the company didn't authorise. With a sealed log, you can show the instruction the agent received, the tool call it made and the result, all unchanged since they were recorded. The customer's claim then turns on what the record shows, not on whose word to trust.

A digital witness doesn't authorise the action or make it correct. It shows that the record of what the agent did, and when, hasn't changed since it was sealed. That's narrower than governance, but it's the part you can't fake: either the fingerprints match or they don't.

How it would work

1. Your system sends a fingerprint of each instruction, tool call and result to WitniumChain through the MCP server, the REST API or the SDK, and gets a witness ID back.
2. The content stays with you. Only the fingerprint is sealed.
3. To check, anyone calculates the fingerprint again and compares it with the sealed one. Change a single character and it won't match.

The first 2,000 witnesses a month are free, and you can start in minutes with the documentation.

What this means for you

If you run AI agents in production, here are three questions worth asking now:

• Could we show what our agents did on a given day, and which instruction they followed?
• Who keeps the log, and could that person edit it without anyone noticing?
• If a customer disputes an agent's action, whose record would a court see first?

The answers don't need a blockchain. They need a plan, and in many cases that plan includes an independent record of what was logged and when.

What to watch

The AI Act's logging requirements for Annex III high-risk systems apply from 2 December 2027 ^[2]. Between now and then, decide what your systems will log, how you'll protect those logs and who'll be able to check them later. Akamai's framework is a decent place to start ^[1].