What an AI agent audit trail needs to contain

Five properties that separate a trail from a log

• Ordering: steps recorded in the sequence they happened, not the order they were flushed.
• Identity: which agent, which runtime, which version, which workspace.
• Integrity: a hash chain you can re-check later, so tampering is detectable.
• Completeness disclosure: an explicit statement of what the capture layer could not see.
• Retention: a known lifetime, with export before expiry.

Ordering is harder than it looks

Agent runtimes emit events from hooks, sub-processes and background tasks. Written naively, a trail loses causality: a tool result lands before the call that produced it.

Inficy connectors keep a per-session ordered ledger and seal each step against the previous step hash, so the order is part of the evidence rather than an artefact of upload timing.

Integrity without overclaiming

Hashing proves that a stored record has not changed since it was sealed. It does not prove that the world behaved as the record describes, and it cannot vouch for anything the capture layer never saw.

That boundary should be stated on the page, not buried in documentation. A trail that oversells itself is worse than no trail, because it invites decisions it cannot support.

Who asks for it

Internal reviewers after an incident. Customers who want to know what an agent touched on their data. Procurement and security teams during a vendor review. Auditors, once agent-driven work touches a regulated process.

All four ask variations of the same question, and all four are satisfied by the same artefact if it is captured properly the first time.