What is an Audit Log?

Unlike a general application log meant for debugging, an audit log exists as a compliance and accountability artifact: it needs to be tamper-evident (entries can't be quietly edited or deleted after the fact), complete for the actions it's scoped to cover, and retained for whatever period regulation or policy requires. Hash-chaining entries — where each new entry incorporates a hash of the previous one — is a common technique to make any retroactive tampering mathematically detectable. Good audit logs capture not just the action but enough context to reconstruct intent: which credential or session performed the action, what the before/after state looked like for a data change, and — for AI-driven actions — what the agent's stated reasoning was at the time. This context is what turns a raw log into something an investigator can actually use to answer "why did this happen," not just "that it happened." For any system that lets an autonomous agent take real actions, the audit log becomes the primary tool for after-the-fact trust: if an agent did something wrong, the log is what lets a human reconstruct exactly what happened, distinguish a genuine bug from a misuse, and fix the actual gap rather than guessing.