Evidence as a Byproduct: The Resume Log Is the Audit Trail
A system built to recover from failure already answers the auditor's most common question. The log the agent reads to resume after a crash is, byte for byte, the artifact the auditor samples. Nobody prepares for the audit, because the evidence is exhaust from normal operation.
The audit trail is the single most asked-about property in the auditor corpus. Across 10-plus published auditor and GRC sources, client questions about AI agents deduplicate to 22 canonical forms, and the trail appears in six or more of them and in every single source organization (see the auditor question bank). The most common version is "show me the audit trail for a specific decision."
The auditor's question is a replay request
Kognitos's SOX auditor question list puts it verbatim at question four: "Show me the audit trail for a specific decision." The evidence shape they describe is a per-transaction execution log: timestamp, trigger, inputs, rule invoked, reasoning, action, system updated, human reviewer. A-LIGN asks the incident version: "If an agent produced an output tomorrow that caused customer harm, could your organization reconstruct what it did and why?"
Every variant of the question is asking you to replay one task, end to end, after the fact. And the bar for what counts is explicit. Vanta's list of nine things auditors want to see ends on "evidence, not policies." A document saying "we log agent actions" answers nothing; the auditor wants the actual trail for the actual decision they picked.
The crash-recovery log is the audit trail
The reference architecture answers this for free. In Anthropic's managed-agents design, the session is "the append-only log of everything that happened," stored durably outside both the harness and the sandbox, and a crashed harness recovers by reading it back and resuming from the last event. The full resume mechanism lives in the session. The log exists because the system cannot recover without it, which means it is written whether or not an auditor ever calls.
So the artifact that lets a crashed harness resume is, byte for byte, the artifact an auditor samples. Map the auditor's four elements onto it:
| Auditor asks for | Where it lives in the session |
|---|---|
| Trigger | The event that opened the task: the issue, message, or schedule that started it |
| Inputs | The prompt and every tool result fed into the model, in order |
| Actions | Every tool call the agent made, with name and input |
| Reviewer | The gate decision, recorded as an event with the identity that made it |
There is no export step and no reconstruction project. Answering the auditor is the same operation as resuming the task: read the log. The query interface this implies, by task, actor, environment, and time window, is its own page: the four-axis audit query.
Append-only and external make the byproduct tamper-evident
SOC 2 Type II does not sample a point in time; it samples across the full audit period. Teleport's mapping of AI agents to the Trust Services Criteria expects tamper-evident logs of "every AI agent action, including inputs, outputs, and trigger events," sampleable across twelve months.
The session design satisfies this structurally, and the audit-trail property holds vendors to it. The log is append-only, so past events cannot be quietly rewritten. It lives outside the containers, so destroying a sandbox destroys nothing in the record. And because logging is the resume mechanism, it cannot silently fall out of use: a system that stopped writing the session log would stop being able to recover from failure, and you would notice the same day. Continuous operation of the control is enforced by the system's own self-interest, which is exactly the "controls were active between audit cycles" evidence a Type II audit wants.
The laptop produced no equivalent artifact, and never claimed to
The laptop model never owed this evidence, because "the human at the keyboard" was the whole answer (the full version of that argument is why the laptop never answered). ISACA's September 2025 analysis of auditing agentic AI states the default plainly: "agentic AI does not offer human-readable reasoning unless explicitly programmed to log it," and "the absence of clear, traceable decision paths undermines the ability to assess compliance, detect errors or bias." On a laptop, nobody programmed it in. The trail is terminal scrollback, gone when the window closes. The external session log is what replaces it.
The byproduct reconstructs a known task, not the four asks outside it
The log reconstructs a known task. It does not answer everything an auditor asks. From the same question corpus, four asks fall outside it:
- Agent inventory. "What agents do you have?", the most common opening question. The log cannot discover agents you forgot you deployed.
- Behavioral drift. Drift and baselines over time, which a per-task log does not track.
- Risk and impact assessments. Governance documents, not execution records.
- Adversarial testing. Testing against injection and hallucination, which the log does not perform.
The log proves what one task did; it says nothing about output quality. Those need governance work the architecture cannot do for you.