Where a person sits in the chain of events, attribution establishes which person. Where no person sits in it, as with an agent acting on its own, attribution is the only way to reconstruct what happened at all. Use a responsibility map for one workflow to name who owns each stage.
Tamper-resistant is the word that carries the weight
A log the operator can quietly edit proves nothing about the operator. A record produced by the party under examination is worth what any such record is worth. So the first question about a record is who can change it, and the second is what it contains.
The service account problem
When a person acts inside a system, the record names them. When an autonomous agent acts, in most deployments today, the record says "service account." It cannot say which agent acted, under whose authority, or on what instruction. Standards work now under way treats this as the central gap, and it is the gap a liability question falls into.
Four questions for any log
- Where is it kept?
- How long is it kept?
- Is each entry attributable to a named person or a named agent?
- Who can alter it, and would anyone know?
For the AI requests that pass through it, Sentinel, an AI gateway, records metadata for each request: counts, which rule fired, and latency. It records metadata only, so check any record against the four questions above before relying on it as proof of who did what.
How to ask it
- A good answer
- A tamper-resistant record with verified coverage by product surface, event type, available content, and retention period, tying covered interactions to an identified person or agent.
- An evasion
- "Everything is logged." Logged where, for how long, attributable to whom, and can it be altered?
- The follow-up
- If this went to litigation, what would you be able to produce?
What to check
- Pick one AI interaction from last week and try to trace it to a person.
- List every agent or automation that calls a model, and note the identity its requests carry.
- Ask your counsel what they would need to produce if a dispute turned on one of those interactions, then check whether the record holds it.
Frequently asked questions
- What makes an AI audit trail tamper-resistant?
- A tamper-resistant record cannot be quietly edited by the party it describes. A log the operator can alter proves nothing about the operator, so the first question is who can change the record, and the second is what it contains. Ask where it is kept, for how long, and whether anyone would know if it were altered.
- Why does an AI log say "service account"?
- When a person acts inside a system, the record names that person. When an autonomous agent acts, most deployments today record only a service account. The record cannot say which agent acted, under whose authority, or on what instruction. Standards work now under way treats this as the central gap.
- What four questions should you ask about any AI log?
- Where is it kept? How long is it kept? Is each entry attributable to a named person or a named agent? Who can alter it, and would anyone know? A vendor answer of "everything is logged" leaves all four of these questions open, and a record that cannot answer them will not hold up in a dispute.
- How do you test your own AI audit trail?
- Pick one AI interaction from last week and try to trace it to a person. List every agent or automation that calls a model, and note the identity its requests carry. Then ask your counsel what they would need to produce if a dispute turned on one of those interactions, and check whether the record holds it.
Keep going
Is it safe to let an AI agent act on company systems?
Who is liable when an AI system causes harm, or an agent acts?
Map one workflow before the next one goes wrong
A practical next step
For regulated work
Sources
- National Institute of Standards and Technology, AI Risk Management Framework 1.0. Trustworthiness characteristics, including accountability and transparency.
- NIST Center for AI Standards and Innovation, AI Agent Standards Initiative, February 2026. Agents run without dedicated identity, authorization, or accountability controls. Reached via secondary reporting; the primary document has not yet been retrieved.