Most teams think auditability is “we have logs.”
Audits and incident reviews require something stronger: a reconstructable decision chain with evidence attached.
Start here:
The minimum viable audit trail (for production)
1) Stable task identifiers
Every agent action must be traceable:
ai_task_id(stable across retries)- owner (who is responsible)
- tenant scope (do not leak cross-tenant context)
2) Explicit status history (not overwrites)
Statuses must tell a story:
- queued → running → needs_review → approved → executed → failed
- include failure reason codes
- include timestamps and who/what caused transitions
3) Evidence linkage
An audit trail without evidence is a narrative without citations.
Evidence should include:
- original documents (quotes, invoices, GRNs)
- extracted drafts (structured fields + diffs)
- references used by the agent (entities, mappings)
Related:
4) Approval decisions (and what was approved)
Approvals are only auditable if you can answer:
- what was approved?
- what evidence was attached at approval time?
- what policy routed this to this approver?
Related:
Safe reruns are part of auditability
In production, you will rerun:
- revised documents
- integration retries
- corrected mappings
If reruns create duplicates or erase history, auditability collapses.
Related: