Reconstructing what an agent did
“The AI did it” is not an audit entry. Six months later somebody will ask how a number was produced or who drafted a change, and the answer has to name an agent, a permission tier, a set of tools and the revisions it read.
What it is, and what it is not
Agent actions recorded in the same hash-chained audit trail as human ones, with enough structure that any answer or action can be reconstructed rather than merely attributed.
It is not a chat log. A transcript records what was said; it does not record which services were called, at which permission tier, against which object revisions, or whether the underlying query would return the same result today.
It is also not a separate AI audit system. Agent actions land in the same chain as everything else, because a parallel log is a log that gets exported separately, reconciled badly, and disbelieved when the two disagree.
What each row records
Enough to answer the four questions somebody actually asks afterwards, and no free text standing in for any of them.
- Which agent, at which tier. Not just that an agent acted, but that the BOM Agent acted at Prepare — which bounds what it could possibly have done.
- Which tools it called. The domain services invoked, in order, with their parameters. This is the difference between a claim and something reproducible.
- Which object revisions it read. Revision-addressed, so the citation resolves to the state that was actually read rather than to whatever the object says now.
- Which user it acted for. Agents inherit permissions, so the answer to who could see this is a person, and the agent is the mechanism rather than the actor.
The failure it prevents
An auditor asks how a cost figure in a change review was produced. The answer is that the assistant said so, and the transcript is available.
The transcript shows a fluent paragraph and a number. It does not show which structure was resolved, under what conditions, or which cost values were current at the time — so the number cannot be reproduced, and nobody can say whether it was right when it was quoted or right by coincidence.
That single unanswerable question devalues every other AI-produced artefact in the system, because the mechanism that produced this one produced all of them. Recording tools and revisions rather than prose is what keeps the answer checkable, and checkability is the entire basis on which anyone should act on an agent's output.
How it meets the rest of the product
The underlying services are deterministic — resolution, impact analysis, comparison — so re-running a recorded tool call with recorded parameters returns identical bytes. That is what turns an audit row into a reproduction rather than a description.
Writes arriving without an attributed actor are refused outright, which applies to agents exactly as it does to people. An unattributed agent action is not a thing that can exist, so there is no category of change with no owner.
The chain is SHA-256 linked row to row, so a tampered or deleted entry breaks verification and the break is locatable. Retention is for the life of the tenant, because an audit trail with a rolling window discards precisely the old entries an investigation needs.
Where an agent abstained, that is recorded too. Knowing an agent declined to answer, and what it could not establish, is frequently more informative than a row saying it answered.
Cost and metering records sit alongside, so a question about spend resolves to the same rows: which agent consumed what, on whose behalf, against which budget. That matters less than correctness and it matters more than people expect the first time an unexpected invoice arrives and nobody can attribute it.
How it meets your ERP
Connector runs are audited on the same terms: the connector, the run, the direction and the objects. So “which system changed this value, and when” has an answer that names a system and a run rather than trailing off into a shrug.
An agent's answer that included an ERP-sourced value records that value's source system and as-of stamp alongside the Manufacturing PLM revisions it read. Reconstructing the answer therefore shows which half was reproducible and which was a cached read of somebody else's record at a moment in time.
Agent actions that trigger an outbound publication are the most consequential rows in the system, and they carry the change, the tier, the approval that authorised the release and the connector run that carried it — because that sequence is what an auditor will walk.
Where the boundary is
The trail records what an agent did and read. It does not record why the model produced the output it produced — model reasoning is not recoverable, and a system claiming to log it would be logging a plausible narrative rather than a cause.
That is the honest limit, and it is the reason the permission tiers exist. If reasoning cannot be audited, the useful control is bounding what a wrong conclusion can cause: an agent at Prepare produces a draft somebody reviews, and the review is the audited human act.
Facts
| Records | Agent · tier · tools called · revisions read · acting user |
| Same chain | As human actions — never a parallel AI log |
| Reproducible | Deterministic services, re-runnable from the recorded call |
| Unattributed writes | Refused — for agents as for people |
| Integrity | SHA-256 chained; a break is locatable |
| Retention | Life of the tenant, not a rolling window |
| Abstentions | Recorded — declining is information |
| Not recorded | Model reasoning — it is not recoverable |
Frequently asked
Is a chat transcript enough?
No. A transcript records what was said, not which services were called, at what tier, against which object revisions. Without those, a number cannot be reproduced and nobody can say whether it was right when quoted or right by coincidence.
Can we reproduce an agent's answer later?
Yes, wherever it rests on deterministic services. Resolution, impact analysis and comparison return identical bytes for the same recorded call and parameters, so an audit row becomes a reproduction rather than a description of something that happened once and cannot be checked.
Do agent actions go in a separate log?
No — the same hash-chained trail as human actions. A parallel AI log is one that gets exported separately, reconciled badly, and then disbelieved the first time the two disagree about the order or the content of what actually happened.
Can an agent act without attribution?
No. Writes arriving without an attributed actor are refused outright by the data layer, and that applies to agents exactly as it does to people. An unattributed agent action is not a category of thing that can exist anywhere in the system.
Do you log why the model decided something?
No, and a system claiming to would be logging a plausible narrative rather than a cause. Model reasoning is not recoverable. That limit is precisely why permission tiers exist — bounding what a wrong conclusion can cause is the control that does work.
Are abstentions recorded?
Yes, along with a note of what the agent could not establish. Knowing that an agent declined to answer a question, and why it judged the evidence insufficient, is frequently more informative during an investigation than a row recording that it answered confidently.
How long is the trail kept?
For the life of the tenant. An audit trail with a rolling retention window discards exactly the old entries that an investigation turns out to need, which makes it a compliance artefact rather than a usable record of what actually happened and when.