AI audit trails that hold up

An AI audit trail records who (or which agent) did what, with which inputs, under which policy, producing which side effects. If any of those fields can be silently edited, you have a diary, not an audit trail.

Treat the trail as part of the product's trust boundary. In clinical and billing contexts, PHI and money already force this thinking. Agent tools that can email, charge cards, or mutate records need the same seriousness.

High-volume logs without integrity checks are easy to flood and easy to doubt. Prefer append-only stores with hash chaining or signed batches. Verify the chain in CI and in an admin path an operator can run without you.

Store enough to reconstruct the decision: tool calls, retrieval ids, model version, policy version, and outcome. Store as little sensitive raw content as the threat model allows. Encryption envelopes help when retention is required.

If audit is a middleware someone can forget, it will be forgotten on the hotfix that matters. Put encryption and audit in internal packages every write path imports. Failed audit write fails the operation.

Scribient's split into API, workers, and front with shared contracts is the pattern: workers that run NLP, coding, or CDS still call the same audit surface as the request path.

Can you show a single user-critical action end to end? Can you prove the log was not edited after the incident? Can you explain gaps (sampling, redaction) without hand-waving?

Answer those three and most security questionnaires get shorter. Fail them and the questionnaire becomes a rewrite plan.