An output log is not an audit trail. The trail carries the decision chain: what triggered the action, which tools it called with what parameters, which identity it used, who approved, because that is what reconstruction means when someone asks.

The mechanism

An existing rule already settles the design argument, though which rule applies depends on how a firm is registered, and the gap is wider than most summaries admit. SEC Rule 17a-4(f) gives a broker-dealer’s electronic recordkeeping system two options: preserve records in a non-rewriteable format, or maintain a time-stamped audit trail permitting recreation of an original record if it is modified or deleted (as amended by Release 34-96034, October 2022). FINRA Rule 4511 pulls the same system requirement into everything a member firm keeps, at a six-year default. An adviser-only firm is under neither. Rule 204-2 sets a five-year floor and no electronic-format regime at all: no WORM requirement, no audit-trail alternative, nothing to choose between. So immutability is one of two statutory options for a broker-dealer, and for everyone else it is simply the cheapest way to answer what 204-2 will still ask a firm to produce.

Nobody upstream keeps that trail. Providers do retain data: Anthropic holds prompts and outputs 30 days by default, longer if flagged, and OpenAI retains abuse-monitoring logs up to 30 days absent a zero-retention arrangement. None of it is a recordkeeping system a firm can produce from. The widely repeated claim that “LLM providers do not maintain logs” is literally wrong; the conclusion it points at is right.

Platform defaults are worse than short. Copilot Studio’s Dataverse conversation transcripts default to 30 days with an automatic bulk-delete job, below every applicable floor: three years under 17a-4(b), six under FINRA 4511, five under 204-2(e)(1). Assume the platform is the archive and the gap is measured in years.

Native instrumentation is thin and uneven. In the 2025 AI Agent Index’s review of 30 deployed agents, 12 provided no usage monitoring or only rate-limit notices, 10 gave detailed action traces with visible reasoning, and 6 summarized reasoning only, with the authors cautioning that “none found” means absent public documentation, not confirmed absence. On the MCP side, one of seven tested clients rated a clean yes on audit logging (Cline, on builds pinned to November 2025); Cursor and Langflow rated no, so the client cannot be assumed to record what tools were called.

Telemetry is rarely the thing that is missing. Microsoft’s own guidance names the real failure: logs never centralized, dashboards nobody builds, SOC workflows never connected to agent data, so risky behaviour surfaces only after an incident escalates. The Sentinel path for Copilot Studio exists and must be assembled: enable audit logging, ingest Purview audit logs, write custom detection rules, add Application Insights, four steps with an M365 licensing prerequisite and no default.

Two agent-specific properties break conventional log schemas. The loggable surfaces differ: tool use, internal reasoning, self-critique and memory operations are separate categories a SIEM schema built for applications never contemplated. Retention must also outlive the agent, since impacts arrive late and a successor re-running the same inputs against the same memory is a continuation whose logs must correlate with its predecessor’s.

The optimistic case is real: agents can be born instrumented in a way employees never were, their actions arguably more legible than a human’s (Kolt). The technology permits comprehensive capture; policy has to require it at deployment rather than retrofit it after an incident.

One caveat governs every use of reasoning traces: logged chain-of-thought is evidence rather than testimony. Models can be systematically influenced by input features their stated reasoning never mentions (Turpin et al., 2023), faithfulness fails to improve reliably with scale (Lanham et al., 2023), and asking an agent afterwards to justify itself produces confabulation. Log the trace; build no attestation, control assertion or examiner-facing explanation on top of it.

What to do

Route agent traffic through one logged chokepoint. A gateway seeing every model call and tool invocation gives a firm one place to attach identity, capture parameters and emit to the SIEM, even for agents on platforms whose native logging sits outside the firm’s control. See egress control and the agent control plane.

Log against a stable per-instance agent identity, never a shared service account. Without one, the record is activity nobody can attribute, and unattributable activity is the same as no log. The identifier comes from agent inventory.

Capture OWASP’s list, the most concrete published:

• The triggering input and the plan or reasoning steps.
• Every tool call with its parameters and results.
• Validation results, errors and state changes.
• Human-in-the-loop interactions including the decision, not just that a prompt appeared.
• Which identity and permission set was used: who the agent thought it acted for.
• A trace ID propagating across steps, and the policy version in force.

Keep the never-log list too: access tokens, secrets, connection strings, PII the firm has no basis to retain. An audit trail full of live credentials is a breach waiting for a subpoena.

Log what the control decided, not only what the agent did. Two research groups arrive at this independently, and both regulators reward it: a record showing a policy was evaluated, what it returned, and why an action was permitted is control-effectiveness evidence, while actions alone prove only that things happened.

Make the log tamper-evident. Append-only storage with HMAC signing or hash-chained entries is the current recommendation, and ISO 27001’s A.8.15 already requires logs to be protected, which matters when the thing being logged can write files. A.8.17 clock synchronization is what makes multi-agent trace ordering forensically usable.

Scale detail to risk rather than logging everything at maximum fidelity. Full-fidelity capture is possible (a research platform recorded every keystroke, edit, API call and intermediate output), but storage, privacy and the surveillance question all bite. Tier-scaled logging has an academic anchor, not just a budget rationale.

Treat the log store as a regulated asset with its own access control. Two independent sources converge on least privilege for reading it: governance metadata broadly accessible for audit, raw step content restricted to incident investigation. OpenAI’s pattern for usage analytics is worth borrowing: classifiers over logs, aggregates reported, humans never reading employee prompts. That is the difference between monitoring and surveillance, and staff notice which one the firm built.

How you’d know it’s working

Run a timed reconstruction drill. Pick an agent action from last week and produce, within an hour: who or what triggered it, which data it touched, which tools it called with what parameters, which identity it used, who approved. Whatever gap that drill exposes is the same gap an examiner will eventually find.

The drill still works for an agent retired two months ago. Retention that dies with the agent fails exactly when delayed impacts surface.

Agent events appear in the SIEM alongside everything else and someone has written at least one detection rule against them. Telemetry landing in a dashboard nobody watches is the named failure mode, not the fix.

What this doesn’t solve

Monitoring identifies problems; it neither penalizes nor prevents them. Kolt’s sentence bounds this entire control family. A SIEM full of beautiful agent traces will document an exfiltration in complete detail while it happens. Prevention lives in egress control, sandboxing and identity and access.

Some threats are undetectable even under perfect capture. Coordination between agents can be embedded in ways indistinguishable from benign interaction, placing a class of multi-agent attacks structurally outside detection-based defence. That analysis is anticipatory rather than observed, and it is the strongest argument for preferring architecture to transcript monitoring.

Provenance graphs, which stitch prompts, invocations and outputs into a queryable dependency graph, are the obvious next step and remain unready. Nobody has defined anomaly detection over them for multi-agent systems, and storage becomes debilitating at scale, so this is a research direction rather than a purchase.

Two circulating numbers about agent-log adequacy are deliberately absent here: that all evaluated frameworks lose at least 30% of causal audit evidence, and that under 20% of enterprise deployments do cross-session behavioural monitoring. Both trace through one survey paper to citations containing neither figure, which makes them unsupported wherever they appear.

Finally, EU AI Act Article 12 logging obligations bind providers of high-risk systems, and Article 26(6) obliges deployers to retain automatically generated logs for at least six months, with a carve-in letting financial-services firms fold that into their existing documentation regime. For most internal agents at a fund this is an analogy, not an obligation, and a firm’s own recordkeeping rule is the sounder basis for the case; the standalone high-risk dates moved out to December 2027 and August 2028.

See also

• Recordkeeping and compliance gaps — the regulatory concern this answers, and the rules in detail.
• Agent inventory and registry — the identifier without which a log line attributes to nothing.
• Cross-session delayed detonation — the failure class that per-session logs, correctly kept, still miss.
• Agent incident response — where the reconstruction drill gets run in anger.
• Observability and eval platforms — who sells the tracing layer, and what they don’t cover.
• Oversight decay — why a logged approval may not be the decision it appears to record.
• Observability & monitoring — the dimension hub.