Three documents from 2026 agree on one thing: if an agent can act, you need a record of what it did and for whom. NIST's NCCoE concept paper on agent identity (February 2026) asks how to ensure agents log actions and intent in a tamper-proof, verifiable way. The MCP 2026-07-28 revision documents OpenTelemetry trace context keys for request metadata. And the OWASP Agent Control Standard, version 0.1, includes an observability layer built on OpenTelemetry and the Open Cybersecurity Schema Framework (OCSF), according to the Cloud Security Alliance.
What's affected
Any team running an agent with tools. Ordinary application logs record that an API was called. They rarely record which model run decided to call it, what text led there, and which human it acted for. Without that, an incident review ends at "the service account did it."
The NCCoE paper lists logging and transparency as a focus area: linking agent actions to the identity of the non-human entity, with visibility into actions taken, data generated and outcomes. It also lists tracking the provenance of user prompts and data inputs.
What to do now
- Log every tool call, not only failures. The MCP tools page tells clients to log tool usage for audit purposes.
- Attach two identities to each record: the agent's own identity and the human it acts for. A shared service account hides the second one.
- Carry a trace ID from the user request through each model step and tool call. Use
traceparentso existing tracing backends can join the pieces. - Record the input source, such as a user message, a retrieved document ID or a web page URL. When something goes wrong, this is how you find the poisoned input.
- Record approvals: who approved a sensitive action, when, and what they were shown.
- Send logs off the agent's host to storage the agent cannot write to or delete.
- Avoid raw secrets and personal data in arguments. Hash or redact before writing.
A minimum record looks like this:
{
"ts": "2026-10-18T09:14:03Z",
"trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"agent_id": "support-triage-v3",
"on_behalf_of": "user:4821",
"tool": "create_ticket",
"args_hash": "sha256:9f2c4a1be07d3358c61a5e9d02f47b8a16c3d95e7f0b24a8d1c6e3f5970ab2d4",
"input_sources": ["msg:77120", "doc:kb-441"],
"decision": "allowed",
"approved_by": null,
"result": "ok"
}
Also keep an agent bill of materials: which models, tools and data sources each agent can reach. The ACS document includes an AgBOM using CycloneDX, SWID and SPDX formats, so the inventory and the logs describe the same thing.
Click through it at your own pace, or open it full screen.
Quick check
Why record both the agent identity and the human it acts for?
The agent identity shows which workload acted. The human identity shows whose authority it used. Incident review and access decisions need both.
