What should an AI coding agent's audit log contain?

A useful audit log for an AI coding agent records who started the session, which agent and version acted, each tool call with its inputs and result, what files or systems changed, and any approval given. It should be exportable, time stamped, and protected from edits by the agent itself.

What the log is for

Three jobs: investigate an incident, prove a control worked, and spot misuse early. Each one needs different detail, so design for all three. A chat transcript alone does not do it, because a transcript shows what was said and not always what was done.

Minimum fields

Notice that prompts and model output are not on the minimum list. They may contain code and secrets, so treat them as a separate, tighter tier of data.

Design choices that matter

• Mask before storing. Redact token like strings from arguments. The log should help an investigation without becoming a second leak.
• Separate from the agent's reach. An agent that can edit its own log can erase its tracks, by mistake or under instruction. Write logs to a place it cannot modify.
• Keep identity real. The MCP security guidance notes that when tokens are passed through without validation, downstream logs may show requests from a different identity than the real actor, which makes investigation harder. Make sure your records tie each action to the right principal.
• Decide retention deliberately. Long enough for investigations and audits, short enough to limit exposure. Align with your own policy, and take legal input where the question is regulatory.
• Make it queryable. A log nobody can search is a file, not a control.

Questions to ask a tool vendor

1. Which events are logged by default, and which can be turned on?
2. Can records be exported to our own systems, and in what format?
3. Are approvals recorded with identity?
4. Can an administrator view activity across users, or only each user's own?
5. How long does the vendor keep its own logs, and who can read them?

If a tool cannot answer these, plan to capture records yourself through a wrapper or proxy.

Review the logs, not just keep them

Schedule a monthly look. Search for blocked actions, new hosts contacted, installs, edits to pipeline files, and sessions outside working hours. Patterns tell you where to tighten policy. Our post on AI agent audit trails versus security logs versus debug logs explains how the three differ.

Safeguard can help at the dependency and pipeline end of this: SBOM and dependency scanning, reachability analysis, policies and gates on pull requests, and agent identity. You can try a free scan at gold.safeguard.sh/scan.

A worked example: one session, five log lines

Imagine a session where an agent fixes a failing test. A useful log might record entries like these, shown as plain descriptions.

From these five lines an investigator can tell who launched the session, what the agent touched, which action needed approval, who approved it, and that one outbound request was stopped. The blocked entry is the interesting one. A single blocked fetch to an unknown host during a test fix deserves a look at the preceding file reads to see what text the agent had consumed.

Building the log when the tool does not

Some tools expose limited records. Add your own capture points:

1. Run the agent inside a wrapper that records launched commands and exit codes.
2. Send network traffic through a proxy that logs hosts and sizes.
3. Use version control as a record of file changes, with agent labeled commits.
4. Pull approval prompts from the tool's output if it offers any.
5. Ship all of it to a store the agent cannot write to.

This stitched record is less elegant than a native one, but it answers the key questions.

Retention and privacy

Logs are data. Decide who may read them, how long they live, and how sensitive values are masked. A practical split is a standard action log kept for the period your policy requires, and a restricted tier for any prompts or outputs, kept for a shorter time with tight access. Where you operate under privacy rules, include the log store in your records of processing and ask your counsel how long you may or must keep it.

Using the log

Schedule a monthly review of these five questions. Findings feed policy changes, such as shrinking the prompt set or adding a host to the allowlist.

Tamper resistance

Write logs somewhere the agent has no rights. Consider append only storage and a separate account for log shipping. If the agent can edit its own record, the record is only as trustworthy as the agent on its best day.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through and notice how ongoing records surface changes.

Quick check

Sources

• Model Context Protocol security best practices

Last reviewed: 19 October 2026.