WHEN THE AGENT BREAKS THINGS, THE LOG IS THE EVIDENCE
Could you prove what your AI agent did last Tuesday?
An agent deleted the wrong records, sent the wrong email, spent the wrong budget. Now comes the question nobody can answer: exactly what did it do, when, and under whose authority? If your agent logs are a pile of stdout, you have no evidence. Check your logging against these 6 fields right now. No signup, nothing installed.
The 6-field log checklist
1
Timestamp in UTC, with timezone explicit. "Around 3pm" is not evidence. Every entry needs an unambiguous instant.
Missing or local-time-only → FAIL. You can't reconstruct a timeline across systems.
2
Actor identity — which agent, which run, which user authorized it. "The agent did it" names no one.
Just a process name → FAIL. You need agent ID + run ID + authorizing principal.
3
Action + tool called, with exact parameters. Not "sent email" — which email, to whom, with what body.
Summaries instead of parameters → FAIL. Summaries are written by the thing you're investigating.
4
Inputs, with secrets redacted. Log what the agent saw — but never log API keys, tokens, or PII in the clear.
Raw secrets in logs → FAIL twice. Your audit trail is now a credential leak.
5
Result and status. Success, failure, what came back. An action without an outcome is half a record.
Fire-and-forget logging → FAIL. You can't tell what actually happened.
6
Tamper evidence. Each entry cryptographically chained to the previous one (e.g. each record stores a hash of the one before it).
record_n.hash = sha256(record_{n-1}.hash + record_n.payload)
// If anyone edits history, the chain breaks. Simple to implement, hard to fake.
Plain append-only file, editable by the agent itself → FAIL. The suspect holds the eraser.
All six present → you can actually investigate an incident. Now make sure the logs are retained and readable under pressure.
If you failed any field, do this now
Add the missing fields before the next incident, not during it.
Separate log storage from the agent — the agent must not be able to rewrite its own history.
Redact on write — secrets should never touch the log pipeline unmasked.
Practice reading them — run a tabletop: "agent X refunded customer Y wrongly — reconstruct it from logs in 10 minutes."
This page gave you the checklist. Agent Flight Recorder implements it — every agent action gets a hash-chained, tamper-evident log entry: who did what, when, with which tools.