The Audit Trail: Evidence and Resume Are One Artifact

Do not build the audit trail as a compliance feature. Build the architecture right and the trail falls out of it, because the artifact that lets an agent system survive a crash is the same artifact that survives an audit. That is the second of the seven properties: the trail is the load-bearing one. It is the most-asked-about property in the auditor corpus this handbook compiled, appearing in six or more of the 22 canonical questions auditors and GRC bodies publish about AI agents, and in every one of the ten-plus source organizations surveyed (see the full question list).

The universal auditor move is question 4 on Kognitos's SOX list: "Show me the audit trail for a specific decision." You should already have the answer, because you built it to keep the system running, not to pass the audit.

The resume mechanism is the evidence

Anthropic's Managed Agents architecture defines the session as "the append-only log of everything that happened," stored durably outside both the harness (the reasoning loop) and the sandbox (where code runs). During the agent loop the harness writes every event with emitEvent(id, event). When a harness crashes, a new one boots with wake(sessionId), fetches the log with getSession(id), and resumes from the last event. Nothing in the harness needs to survive, because the log is the state.

Anthropic built this for operations, not auditors. Their coupled design was a "pet": when a container failed the session was lost, and because the container held user data, engineers could not shell in to debug. The external log fixed both. A log complete enough to resume an agent from is complete enough to reconstruct what the agent did, and a log external enough to outlive a dead sandbox is external enough to outlive a motivated edit. Resilience and auditability are not two systems. They are two readers of one artifact.

External and append-only are the load-bearing words

Per-task environments are disposable by design (one environment per task), so any log stored inside one is disposable too. External storage is what makes the record survive the teardown. Append-only is what makes it tamper-evident: events are added, never rewritten, so the record an auditor samples in month twelve is the record that was written in month one.

That matters because auditors sample across the whole period. Teleport's SOC 2 analysis expects tamper-evident logs of "every AI agent action, including inputs, outputs, and trigger events," and a Type II report samples evidence across the full audit window, not a point-in-time screenshot. ISACA's September 2025 piece on auditing agentic AI states the failure mode plainly: "agentic AI does not offer human-readable reasoning unless explicitly programmed to log it," and "the absence of clear, traceable decision paths undermines the ability to assess compliance, detect errors or bias." The log is not a byproduct you hope exists. It is programmed in, at the point of action.

Queryable means four axes, not grep

An auditor's question is always some form of "show me everything that touched X between these dates." So the trail must be queryable per task, per environment, per actor, and per time window; the mechanics get their own page at the four-axis audit query. The evidence shape auditors describe is specific. Kognitos's SOX list calls for per-transaction execution logs: timestamp, trigger, inputs, reasoning, action taken, system updated, human reviewer. A-LIGN's self-assessment asks the reconstruction version: "If an agent produced an output tomorrow that caused customer harm, could your organization reconstruct what it did and why?"

What gets recorded is every step of the task lifecycle: the prompt, the agent's actions and tool calls, the review decision, test results, the merge event. Intercom's bar, "labelled, logged, and queryable", is the published proof that a team shipped this and took it through auditors.

The bar is rising toward tool-call-level detail

The AIUC-1 Q2-2026 standard update requires tool-call logging including "MCP server-level metadata like tool name and input parameters" (control D003.3). Vanta's auditor-preparation guide distills the meta-question: "evidence, not policies." A written policy that says agents are logged is worth nothing; system-level logs showing the control operated continuously are the answer. A session log that records every tool call as an event clears the rising bar by construction. See evidence as a byproduct.

What the log does not answer

Two fences. First, the trail answers "what happened"; it does not detect behavioral drift. A-LIGN's "if an agent started behaving differently today, who would notice?" needs baselines and monitoring on top of the log, and the corpus tags that as a gap none of the seven properties closes. Second, the trail governs agents you know about; it does not force discovery of unknown ones. And one corpus gap worth naming: as of June 2026, no major audit firm has published a dedicated FAQ on AI-generated code. That vacuum is currently filled by vendor SEO content, so the code-specific evidence expectations here are directional, not settled.

The session log starts as a resume mechanism, covered in the session.