How do I keep an audit trail of which human authorized an AI agent's actions?

What should I check, step by step?

1. Give each agent its own identity (service account, OAuth client or API key), and don't let it act under a person's own credentials, or the log will show that person did everything.

2. Write a grant record whenever a person authorizes work: grant id, the approver's identity from your identity provider (not a typed name), the agent, the purpose, allowed actions and targets, limits such as amount or data categories, start and expiry, and how they approved (UI click, signed request, ticket).
3. Carry the grant id with the work, in the token, a header or a tool argument, and write it into every tool-call log entry so each action points at exactly one grant. With RFC 8693 delegation tokens, sub names the user and act names the agent.
4. For risky actions, record the approval per action: who was asked, what they were shown (the exact arguments, or a hash of them), their answer and the time. Keep one-off approvals distinct from standing rules, and log every rule change with its author.
5. When an agent hands work to a sub-agent, record the hand-off as a new, narrower grant that names its parent, so you can rebuild the chain from the person to the last actor.
6. Log refusals, expiries and revocations as well as approvals. A denied request or a revoked grant is evidence too.
7. Keep personal data to what you need: a stable user id rather than an email where possible, and no tokens, passwords or session ids in the log (OWASP).
8. Make the trail tamper-evident: append-only storage written by an account that can't edit or delete, plus regular hash commitments kept somewhere the agent's operator can't rewrite.

What the standards give you

RFC 8693 distinguishes impersonation from delegation. When A impersonates B, A is indistinguishable from B in that context. With delegation, A keeps its own identity, and a composite token names both parties. An audit trail needs delegation, so the agent stays visible as the actor.

• The act claim names the current actor. Nesting act claims expresses a chain of delegation, with the least recent actor most deeply nested, and the RFC calls this a history trail. For access control only the top-level claims and the current actor count; prior actors are informational. The may_act claim states who is authorized to become the actor. To limit abuse of delegated rights, the RFC suggests the scope claim and limited token lifetimes.
• RFC 9396 adds authorization_details, an array of JSON objects, each with a required type and optional fields such as actions and locations. A grant can then say 'initiate a payment of 123.50 EUR to Merchant A' instead of a coarse scope. Store that object with the grant record and you have exactly what was approved.
• OWASP's Logging Cheat Sheet lists who (human or machine user) and user identity among the event attributes to record. It also asks for tamper detection, protection against modification and deletion, and a process that notices when logging stops.

What an agent tool's telemetry does and doesn't tell you

Claude Code's OpenTelemetry tool_decision event records accept or reject plus a source. user_temporary means a one-time Yes at a prompt, and user_permanent means 'don't ask again', which saves an allow rule. user_reject and user_abort are refusals. hook means a PreToolUse or PermissionRequest hook decided. config covers decisions made without a prompt: by settings, managed policy, command-line flags, the permission mode or the auto mode classifier.

• The docs note that config doesn't say which of those sources matched. In the interactive CLI, later calls covered by a saved rule or a session-wide grant also report config. The telemetry shows that a decision was automatic, not which person wrote the rule, so keep settings and policy files in version control, where each rule has an author and a reviewer.
• Events carry user.email when it's available, plus a tool_use_id you can join to your hook logs. In Claude Tag channel sessions, Claude works as the organization's shared identity, and the docs say not to rely on the user.* attributes to identify who tagged Claude. Record the requester yourself in that case.