Log every AI assistant action in your security workflow with enough detail to reconstruct it: who asked, what input the model saw, what it returned, which tools it called and what a human decided. Without that record you cannot review mistakes, investigate misuse or show an auditor how decisions were made.
Why this matters
OWASP lists logging and monitoring of extension activity as a damage-limiting measure for excessive agency. It does not prevent bad actions, but it lets you notice and review them. For an assistant that can change tickets or systems, the log is also your evidence.
The core record
For each interaction, capture:
- Timestamp and request ID. One ID that ties everything together.
- Who asked. The analyst or system that triggered the run, and the identity the tools used.
- Model and version. Models change, and results change with them.
- Prompt template version. The wording you used, not only the filled in text.
- Input snapshot. The exact data the model received, after redaction. See what log data to redact.
- Output. The raw response and the parsed result.
- Tool calls. Name, arguments, result and whether it succeeded.
- Human decision. Approved, edited or rejected, by whom, and any note.
Protect the log itself
Your audit log will hold sensitive material. Store it with access limited to a small group, set a retention period you can justify, and keep it separate from the assistant's own permissions so a compromised assistant cannot edit its history. Plan for tamper resistance, such as write-once storage or forwarding to a separate system.
Because the input snapshot may contain data you redacted from the model's view, apply the same redaction rules to what you store unless you have a reason not to.
Make it reviewable
A log nobody reads is only a cost. Schedule a sample review. Pick a few runs each week, compare the assistant's output with what actually happened and note errors. Feed that into the measures in metrics for AI alert triage.
Alert on odd patterns too: a spike in tool calls, an action outside normal hours, or a tool the assistant rarely uses.
What to do in an incident
If you suspect the assistant was manipulated, the log should let you answer: what text did it read, what did it do next, and who approved it? Pair this with the controls in AI SOC agent permissions.
Safeguard note
Safeguard provides compliance and evidence automation, and agent identity for attributing agent actions. These can support your records, but the fields above should be captured at the point where your assistant runs.
Quick check
Should I log the full prompt?
Yes if you can store it safely, since you cannot review what you did not record. Apply redaction and access limits to the stored copy.
How long should I keep these logs?
Set it by your incident response, privacy and audit needs, and write the period down. This guide cannot give a universal number.
Sources
Last reviewed: 19 October 2026.
