An audit log that records what the agent did but not why is half a log

For an agent, the action is rarely the interesting part. The why is. An audit trail that captures the call but not the reasoning, context, and inputs behind it cannot answer the question every investigation asks.

B

Balagei G Nagarajan

4 MIN READ


An iceberg with the logged action above water and the reasoning, context, and inputs hidden below

Key facts.

  • The EU AI Act (Regulation 2024/1689) Article 12 requires high-risk AI systems to automatically record events over their lifetime to ensure traceability of their functioning. source
  • TRAIL (arXiv:2505.08638) shows that localizing where an agent went wrong requires the full trace, with 841 errors annotated across reasoning, planning and execution in 148 traces. source
  • The OpenTelemetry GenAI semantic conventions define spans for agent steps, tool calls and reasoning context, the schema that makes a why-complete trail possible. source

Why is the action alone insufficient?

Because the action is the same whether the agent was right or wrong. An agent that issues a refund logs an identical line whether it followed policy, misread the request or obeyed an instruction hidden in a document it retrieved. The log of the action cannot distinguish these, so an investigation that has only the action has only the question, not the answer. What separates a correct refund from a manipulated one is the reasoning the agent followed, the context it was operating in and the inputs it received, including the ones an attacker may have planted. TRAIL's work makes this concrete for debugging: localizing an agent's error requires the trace across reasoning, planning and execution, not just the final step, because the failure usually originated somewhere upstream of the action you can see.

A more capable model does not make the why dispensable, because a capable agent can still be steered by a hidden instruction or fooled by a misleading input and only the captured context shows it. This is why regulation is moving toward requiring traceability rather than mere logging: the EU AI Act's Article 12 obliges high-risk systems to record their operation so it can be traced over the system's lifetime, which a what-only log does not satisfy. The practical path is a schema that captures the right things, which is what the OpenTelemetry GenAI conventions provide, with spans for agent steps, tool calls and the surrounding context. The reasoning has to be recorded as it happens, because no audit can reconstruct a decision rationale that was never written down.

Iceberg diagram with action at the tip and reasoning, context, inputs, and tool results submerged

What does a why-complete audit trail capture?

The action, so you know what happened. The reasoning, so you know the rationale the agent followed to get there. The context, so you know the state and instructions it was operating under, including retrieved content that may have steered it. The inputs and tool results, so you can see what the agent actually saw rather than what you assume it saw. And the linkage between them, so the trail reconstructs the decision rather than listing fragments. The EU AI Act frames this as traceability of functioning; TRAIL shows why the full trace is what makes error localization possible; OpenTelemetry's conventions give the schema to capture it consistently. A trail with all of this answers why. A trail with only the action answers nothing an investigation actually asks.

CapturedWhat-only logWhy-complete trail
ActionYesYes
ReasoningNoRecorded
Context and inputsNoRecorded
Answers "why did it do that?"NoYes

The Pattern Intelligence Layer is where the why is captured alongside the what. Reasoning, context and inputs are recorded at the pattern level as decisions happen, so an audit trail reconstructs the decision rather than just listing the action. Reliability at the pattern level is what turns a log that records what into a trail that answers why.

Frequently asked questions

Can't I reconstruct the reasoning later from the inputs?
Not reliably. The agent's reasoning is non-deterministic and depends on context that may not be reproducible. If it was not recorded as it happened, it is gone.

Isn't capturing all of this expensive?
It has a cost, but a schema like the OpenTelemetry GenAI conventions makes it structured and manageable and the alternative is an audit trail that cannot answer the question that matters.

Does the EU AI Act actually require the reasoning?
Article 12 requires traceability of the system's functioning over its lifetime. A log of bare actions does not make functioning traceable, so the context behind them is part of meeting the obligation.


Share this post

Join the discussion

Have a take, a war story, or a question? Sign in with GitHub to comment and react. Comments are powered by GitHub Discussions, ad-free and yours to moderate.

Continue Reading

Find where your agent breaks, before you build it

Faultmap maps where your agent will fail from the goal and your data, then hands you the first test suite it has to pass.