Audit trails for autonomous agents

Minimized, but not useless

The instinct to log everything collides with data minimization, and with the fact that agent arguments routinely contain exactly the data you are trying to protect. The resolution is to log the decision rather than the content: identifiers, typed classification, evidence references, reason codes, policy revision, versions and timing.

That record is small enough to keep for years and specific enough to answer the questions that arrive years later.

Eight fields that make a record defensible

If a record is missing any of these, it will not survive scrutiny.

• Policy revision id and digest — exactly which rules applied.
• Evaluator version — which engine produced the result.
• Classifier version — which model labelled the action, if any.
• Typed classification — action type, resource sensitivity, purpose category.
• Matched rule ids — which rules fired, not just the outcome.
• Reason codes — why, in a form you can aggregate.
• Evidence ids and confidence — what the decision rested on.
• Chain link — the hash of the previous entry.

Determinism is an audit property

If the same inputs can produce different outputs, your record is a log of events rather than evidence of a control. A pure evaluator with an explicit evaluation timestamp means an auditor can replay a historical decision and get the same answer, byte for byte.

This is also why the clock must be an input rather than an ambient call. A function that reads the wall clock cannot be replayed, only approximated.

Tamper-evidence beats trust

Hash-chaining costs almost nothing at write time and changes the conversation entirely. Add an append-only constraint at the database layer, and the claim moves from 'we do not edit the ledger' to 'an edit would be detectable' — which is the only version an assessor can act on.