AI agent audit logs usually fail by recording the conversation and missing the actions. A useful trail ties each tool call to a person, a time, the approval given and the result, and sits where the agent cannot edit it. These are the seven mistakes that come up most often, with a fix for each.
Why do agents need logs of their own?
OWASP's guidance on Excessive Agency says logging and monitoring do not prevent harm, but they limit damage: recording the activity of extensions and downstream systems helps you spot undesirable actions and respond quickly. In other words, logs are what turns a surprise into an incident you can scope.
Regulation points the same way for some systems. Article 12 of the EU AI Act requires high risk AI systems to technically support automatic recording of events over the lifetime of the system, so risks and substantial modifications can be spotted and operation can be monitored. It applies to high risk systems only, so check whether yours is one before assuming it is in scope. The Act text lists specific minimum fields only for certain biometric systems.
NIST's AI Risk Management Framework is voluntary and organizes work around Govern, Map, Measure and Manage. It is a reasonable place to anchor an internal logging standard, though the page we fetched does not prescribe log fields.
Mistake 1: logging prompts but not tool calls
The prompt tells you what was asked. The tool call tells you what happened. Record the tool name, arguments, target system and the response status. If a call changed something, record what.
Mistake 2: no identity on the action
OWASP recommends that actions taken for a user run in that user's context with the narrowest OAuth scope. Your logs should show the same: which human, which agent, which credential. A log that says "agent did it" cannot answer who was accountable.
Mistake 3: logs the agent can write or delete
If the agent has a credential that can edit the log store, the log is only as honest as the agent. Ship events to a separate append only destination with its own access controls. Keep the agent out of it.
Mistake 4: forgetting approvals
OWASP advises keeping a human in the loop for high impact actions. Then log the approval: who approved, when, what they were shown and what they decided. Denials matter as much as approvals.
Mistake 5: logging secrets and personal data
Tool arguments and model outputs can carry tokens, customer data and private code. Redact known secret patterns at write time and decide retention up front. A log full of live credentials is a second breach waiting to happen.
Mistake 6: no baseline for consumption
OWASP's LLM10 guidance on unbounded consumption suggests logging and anomaly detection for unusual consumption, alongside rate limits and quotas. Record token counts, call counts and cost per run, so a loop or a runaway agent stands out against normal.
Mistake 7: no way to replay a run
Teams keep fragments in three systems and cannot rebuild the sequence. Give every run an ID, carry it through every tool call and downstream request, and keep timestamps in one format. If you cannot walk a run from request to final action in ten minutes, the trail will not hold up in a review.
What about MCP and tool servers?
If agents reach your systems through a tool protocol server, that boundary is the best place to log, because every action passes through it. Log there as well as in the agent. Safeguard's MCP server at mcp.safeguard.sh has unlimited tool calls on every plan, but whichever server you use, confirm what it records and for how long.
What to do
- List every tool the agent can call and what each can change.
- Log tool name, arguments, result status, run ID and time for each call.
- Attach the human and the credential to every action.
- Send logs to a separate store the agent cannot modify.
- Record approvals and denials for high impact actions.
- Redact secrets and personal data before writing, and set retention.
- Track token, call and cost totals per run and alert on outliers.
- Rehearse a replay of one run each quarter.
Quick check
Do all AI agents need EU AI Act Article 12 logging?
No. Article 12 applies to high risk AI systems. Check your classification, but logging actions is good practice anyway.
Is a chat transcript an audit trail?
Not by itself. It omits tool calls, approvals and results, which are what show what the agent did.
Where should agent logs live?
In a store separate from the agent's own permissions, ideally append only, with a run ID tying events together.
Sources
- OWASP GenAI: LLM06:2025 Excessive Agency
- OWASP GenAI: LLM10:2025 Unbounded Consumption
- EU AI Act, Article 12: Record-keeping
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
