Key takeaways
- An AI agent audit trail needs four layers: delegated authority, decision context, execution and outcome.
- Agent logs are useful for explaining decisions, but TODAQ Press argues they are reconstructions written by the same system that acted.
- EU AI Act Article 12 asks high-risk AI systems to allow automatic logging of events; Annex III high-risk obligations now apply from 2 December 2027.
- Proof bound to the transaction at execution gives auditors integrity evidence they can verify offline, without trusting the organization that kept it.
- Proof cannot show a decision was correct or within policy, so budgets, approvals and access controls remain essential.
What is an AI agent audit trail?
An AI agent audit trail is the record an auditor uses to answer four questions about an agent's conduct. Who gave the agent its authority, and what were the limits? What did it decide, and on what basis? What did it actually execute? What came back?
Each question needs a different source of evidence:
- Delegated authority: the budget, approval limits and access rights a person granted.
- Decision context: prompts, tool calls and the agent's own account of its reasoning.
- Execution: what was paid, settled or changed, by whom and when.
- Outcome: what the counterparty delivered in return.
Many teams already capture decision context in application logs. Execution needs particular care. When an agent spends money, the execution layer is where disputes, chargebacks and regulatory questions land, and it is where the evidence has to hold up under adversarial scrutiny.
Why are audit logs for AI agents hard to rely on?
Audit logs for AI agents are indispensable for debugging and for explaining behavior. Their limit is evidentiary. A log is written by the system that acted and stored by the organization that runs it, so its weight depends on trusting both.
TODAQ Press makes a sharper argument in You Cannot Audit a Probability. When an agent reports what it did, "that log is itself a language model output: a reconstruction, produced by the same probabilistic engine that executed the action." Such a record "can be internally consistent, confidently written, and factually wrong."
The essay adds that engineering discipline helps, within limits: "Better reliability practices reduce the frequency of errors; they do not change the nature of the record." On hardware attestation, it notes that "The hardware integrity is provable; the semantic accuracy of the record is not."
The practical question for an audit team, in the essay's words: "The question is not whether logs exist. It is whether they are accurate and whether the organization can prove it."
What are the EU AI Act logging requirements?
The EU AI Act sets explicit logging obligations for high-risk AI systems. Article 12 states that "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." The logs support traceability, risk identification, post-market monitoring and monitoring of operation (Article 12).
Article 19 covers retention by providers, and Article 26(6) covers deployers: each keeps the automatically generated logs under its control for a period appropriate to the purpose, at least six months unless other law says otherwise. Providers that are financial institutions keep them as part of their documentation under financial services law.
The dates have moved. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved stand-alone (Annex III) high-risk obligations, including credit assessment, from 2 August 2026 to 2 December 2027, and AI in products under Annex I to 2 August 2028 (Legal 500). Some earlier commentary still cites August 2026.
Whether a given agent is a high-risk system, and which logs you must keep, depends on its use. Confirm with your counsel.
What do other frameworks ask for?
- NIST AI RMF 1.0 (January 2023) is voluntary. Its four functions are Govern, Map, Measure and Manage, and its trustworthy-AI characteristics include "accountable and transparent" (NIST).
- ISO/IEC 42001:2023 sets requirements for establishing, implementing, maintaining and continually improving an AI management system (ISO).
- OSFI Guideline E-23 (Canada), effective 1 May 2027, covers AI and machine-learning models at federally regulated financial institutions. Vendors must supply adequate documentation, and third-party models are validated and monitored commensurate with risk (OSFI).
For a framework-by-framework map, see AI governance for agentic payments.
What does AI agent accountability require?
AI agent accountability starts from a position that recent law and decisions support: automating an action does not move responsibility onto the software.
California AB 316, signed on 13 October 2025, adds Civil Code section 1714.46. A defendant that developed, modified or used AI may not assert that "the artificial intelligence autonomously caused the harm to the plaintiff" (LegiScan; Baker Botts commentary). In Moffatt v. Air Canada, 2024 BCCRT 149, a company was held responsible for what its chatbot told a customer.
Central-bank and IMF commentary is also relevant. As reported in the TODAQ Press essays, a Bank of England Bank Underground post (21 May 2026) said legal responsibility for an agent's actions remains with the human deployer. An IMF Policy Note by Davidovic and Tourpe (24 April 2026) proposed separating probabilistic AI decisions from deterministic payment execution.
If the deployer carries the liability, the deployer needs evidence it can stand behind. See AI agent liability for more on disputes.
How does proof at execution improve agentic AI auditability?
Agentic AI auditability improves when the execution layer stops depending on anyone's account of it. TODAQ Press puts the design requirement this way: "The record of what happened needs to be bound to the transaction at the moment of execution, before any language model generates a summary of it."
Qatom transactions work this way. Each holding is a TODA file whose Proof of Provenance, built from "rigs," forms an unbroken, verifiable chain of custody. A rig proves non-equivocation: no conflicting version of the history was produced. Double-spend prevention is a proved theorem in Simple Rigs Hold Fast. Authorization lives in the file too: each update must satisfy the previous step's requirements, such as specific signatures.
Settlement and the verifiable record are the same operation. The proof travels inside the file, so an auditor verifies it locally and offline. As the essay When The Transaction Becomes The Record states, any party "can verify it independently without trusting the organization that originated it." The cryptographic proof of payment guide covers the mechanism in detail.
What does the proof show, and what does it not?
| Proves | Does not prove |
|---|---|
| What was executed, paid and settled, and when | That the agent's autonomous decision was correct |
| Which twin paid, which received, and under which authorization | That the agent stayed within its intended policy scope |
| That the history was not altered or substituted | That the original data or judgment was accurate |
| That any party can verify it offline, without the originator | A system-wide view for macro-prudential monitoring |
| That no conflicting version of the history exists | That regulators accept it; regulators have not formally opined on such records, and supervisors are not yet familiar with rigging trees |
When The Transaction Becomes The Record is explicit about the first limit: "It cannot guarantee that an autonomous decision was correct, or that the agent acted within its intended policy scope." The Missing Middle essay adds: "Verification does not equal truth."
What should an AI agent audit trail contain?
Map each audit question to its evidence and to the control that still has to exist around it.
| Audit question | Evidence | Control you still need |
|---|---|---|
| What authority did the agent have? | Separate agent wallet and budget (A3, A8); auto-approve limit (A9) | A written delegation policy per agent |
| Did a human approve larger spends? | Approval by passkey or phone app above the limit (A14) | Approvers check item, seller and price (A31) |
| What was paid, to whom, and was it altered? | Transaction id, emailed proof of purchase, TODA proof (A15, A17, C8) | Retention aligned with your obligations |
| Was each sale delivered once? | Seller checks X-Qatom-Transaction-Id (B20) | Monitoring of retries, which are new charges (A28) |
| Why did the agent act? | Application and model logs | Log review; logs cannot be verified by the proof |
| Who could move funds or keys? | Role-based access per twin (C29); revocable keys (B29) | Access reviews and key rotation (B24) |
| Can the record go to an auditor? | Ledger export as CSV (C9); .toda file download | A disclosure process by consent |
How do you build an AI agent audit trail for payments?
- Write the delegation down. For each agent, record its purpose, budget and the approval limit above which a human must say yes.
- Enforce it in the wallet. Give the agent its own funded wallet, so the budget is a hard ceiling, and set the auto-approve limit.
- Require strong approval. Use passkeys or the phone app for approvals, and train approvers to check the item, seller and price.
- Keep decision logs. Capture prompts and tool calls in your own logging, and treat them as context, with the limits above.
- Keep execution proof. Store transaction ids and receipts, and download the .toda files for material payments (C7, C8).
- Export on a schedule. Export twin ledgers as CSV and reconcile them with your books.
- Test verification. Have internal audit verify a sample of files offline, outside your production systems.
Privacy holds throughout. TODAQ Press describes the principle as "Privacy is the default; visibility is conferred by consent," so you decide which auditor or supervisor receives the full record.
Further reading
- TODAQ Press, You Cannot Audit a Probability: The Agentic AI Trust Wall (12 May 2026)
- TODAQ Press, When The Transaction Becomes The Record (20 May 2026)
- TODAQ Press, Settlement Without Proof (19 May 2026)
- Coward and Toliver, Simple Rigs Hold Fast, and the Rigging Specifications
Next steps
- Read the overview for risk, security and compliance teams: Qatom assurance.
- Walk through approvals, proof and record export with the team: book an enterprise demo.
- Turn this into a control set: agentic payments risk controls.