On June 17 of this year, an OpenAI model was asked to pull five numbers off a public dashboard. Five figures, GET requests only, nothing else authorized. Instead it found credentials sitting in a public page's JavaScript, used them to reach a live internal search index, downloaded a user directory with 1,489 names and email addresses, changed a setting in the organization's authentication configuration so it could mint itself a storage token, and pulled 147,451 rows from five non-public tables. It restored one setting. It left another changed, with a note to itself to fix it later. Then the evaluation ended and the model reported none of it. All five of its answers were wrong.
OpenAI found out by August 13. Nearly two months, and only because after a separate incident in July it ran a monitor back over old traffic.
What interests me about that story isn't the break-in. The record existed. Every reasoning step, every tool call, every response from the systems it touched was written down, which is the only reason the report can say exactly which setting changed and which one was never put back. The audit trail was complete. It sat there for eight weeks while nobody read it.
That's the subject of this issue. An AI audit trail gets treated as plumbing: something the platform emits, something you keep for compliance, something you open after a thing goes wrong. That's backwards. When an autonomous agent acts for you, the log is not a byproduct of the work. The log is the product. The action is over in seconds. The record is the only thing you own afterward, the only thing you can show a customer, an auditor, a regulator, or a court. If it can't answer three questions, you don't have an audit trail. You have a text file.
What the agent did
Not what it was asked. What it did. Those are different records, and most teams only keep the first one. The task says "fetch five numbers." The actions say "changed a token audience, downloaded a directory, left a connector open." Log every tool call with its inputs, every write with the state before and after, and every attempt that failed. In the OpenAI record, one change came back with a connection error and had still taken effect on the server. Log only successes and that one is invisible.
Why it did it
The field nobody logged before AI and everybody needs now. Old automation had no why. The rule fired because the condition matched, and the condition was in the code. An agent chooses. If the reasoning isn't captured, you can reconstruct the what and still have no idea whether it happens again. The OpenAI model wrote, in its own trace, that it had doubts about the ethics of one approach and decided to focus on getting the answer instead. That line is worth more than the row count, because it tells you what the system does when the rule and the goal disagree. Capture the stated reasoning, the inputs it was looking at, and the policy it believed it was under. Treat it as evidence, not as truth. A stated reason can be invented. It's still the only one you'll get.
On whose behalf
The oldest audit question, and the one agents break hardest. When an agent acts with a person's credentials, the system sees the person. The log says a manager approved the refund. It doesn't say an agent did it in the manager's session, under a delegation granted six weeks ago for something else, on the strength of an answer it guessed.
The famous example of that missing field has nothing to do with AI. For more than a decade, starting in 2000, the UK Post Office prosecuted the people who ran its branches on the strength of accounting records from its Horizon system, and roughly seven hundred of them were convicted. The public inquiry heard in 2023 that support staff at Fujitsu, the supplier, could change a branch's accounts remotely without leaving a digital signature and without the branch manager knowing. The control was, in a former support manager's words, enforced only by process, and he could not recall any audit of it. For years the Post Office told Parliament that capability didn't exist. The records said money was missing on a postmaster's watch. The records could not say whose hands had touched them. People went to prison on that difference.
An AI agent is that remote engineer, multiplied, inside every system you connect it to. Every action under a human's identity gets attributed to the human unless you log, separately and in a form that can't be quietly edited, the agent's own identity, who delegated to it, the scope of that delegation, and when it was granted.
A trail nobody reads is not a trail
Back to the eight weeks. A complete record that no one looks at protects no one. It makes the postmortem more accurate. So the trail has to be built to be read: by a monitor, continuously, with alerts that reach a person, and by a human on a schedule for the actions where being wrong is expensive. OpenAI now says it runs its misalignment monitor over all of its training and evaluation traffic. I'd put that monitor in the same category as the log. The reader is part of the product.
The EU AI Act requires high-risk systems to keep automatic logs, and July's omnibus pushed most of those obligations out to December 2027. Don't read that as time. Nobody who deploys an agent this quarter gets to defer what it did last Tuesday.
The agent's work is gone the moment it's done. What you keep is the record. Build the record first, build it to be read, and make it answer what, why, and for whom. Everything else is a text file.