Corobate

Agent infrastructure

Audit trails for AI agents: proving what your agent did

The moment an agent can spend, send, sign, or ship, "what did it do and why" stops being a debugging question and becomes a liability question. Transcripts and traces don't answer it. Here is what does.

01Why agent logging is different

Chat logs record conversation. Agents take actions.

A chatbot that gives a wrong answer embarrasses you. An agent that acts on one — places the order, approves the refund, updates the ledger, messages the customer — creates facts in the world that someone later has to defend. And agents compound the problem in ways ordinary software doesn't: they act autonomously (no human clicked "confirm" on each step), compositionally (one agent delegates to another, and responsibility smears across the chain), and on model-generated evidence (a step's input is often another model's unverified output).

When the question arrives — from a customer, an auditor, opposing counsel, or your own post-incident review — a folder of traces and chain-of-thought text answers almost none of it. Reasoning text is narrative: it cannot be re-run, it proves nothing about what the agent actually knew, and whoever operates the logging stack could have edited it.

02The five questions the record must answer

Work backwards from the person holding the "why did your agent do this" letter.

1 · What exactly was decided?

The consequential action — not the token stream around it. Approve, deny, execute, escalate, or the one that saves you: withheld.

2 · What did the agent know, and how good was it?

Each input graded by provenance: verified against an authoritative source, modeled, or merely asserted by another model. An agent acting confidently on ungraded evidence is the incident report you haven't had yet.

3 · On whose authority?

Which principal, which delegation, which configuration of rules — pinned to versions, so "the policy changed since then" is a checkable claim instead of an escape hatch.

4 · Should it have refused — and did it?

The strongest evidence of a well-governed agent is a sealed record of the times it declined to act because required evidence was missing or stale. Refusals that vanish from the record aren't governance; they're curation.

5 · Can an outsider check any of this?

If verifying the record requires your servers or your goodwill, its evidentiary weight approaches zero exactly when stakes are highest. The record must be tamper-evident, independently time-anchored, and re-runnable by a stranger.

03What this looks like in practice

One sealed receipt per consequential decision — human or machine.

Corobate's answer is the attestation receipt: at each consequential step, the agent's evidence is graded, its confidence is capped by the weakest required input, the verdict — including honest abstention — is sealed into a hash-chained record, and the seal is anchored to an RFC 3161 public timestamp authority unaffiliated with us or with you. The receipt travels with the work. Anyone — customer, auditor, counterparty — can verify it in a browser, offline, without asking permission.

Delegation chains compose the same way: each hop issues its own receipt, so "which agent, on whose authority" has an answer at every level rather than a shrug at the end. And because receipts are reproducible, your post-incident review can re-run the decision as the agent saw it — not as memory and stale dashboards reconstruct it.

The honest boundary: receipts record and prove decisions; they do not make an agent's judgment good. What they change is accountability: a bad decision with a sealed receipt is a fixable process; a bad decision with editable logs is a credibility crisis.

04Go deeper

Book a partner briefing → partners@corobate.com