We're designing the audit log for our AI agents and keep seeing the IETF Agent Audit Trail draft mentioned. What does it require in each log record, why does it want some records written before the agent acts, and is it actually a standard yet?

What should I check, step by step?

1. Give every record a fresh UUIDv4, a UTC timestamp with milliseconds, a persistent agent_id URI and the semantic version of the agent software.

2. Name the principal on every record: whether a human, organization, service or agent authorized it, a pseudonymous or role-based id for a person, and authority_ref pointing to the grant, delegation record or token it relied on (null, with the basis explained, if there isn't one).
3. Write the decision record before the action runs whenever the agent is stopped or sent to a human. The draft makes pre_execution mandatory for denied and escalated decisions and denied delegations.
4. For high-risk systems under the EU AI Act, write a pre-execution authorization record before any action that changes external state, moves money or delegates, and a post-execution record of the result that links back to it.
5. Chain the records: each carries the previous record's id and the SHA-256 of its RFC 8785 canonical JSON, so a deleted or edited record breaks verification.
6. Hash, don't store, prompts, outputs, tool parameters and reasoning. Keep raw data in a separate access-controlled system linked by record_id.
7. Above trust level L1, have a component outside the agent write and sign the records with its own key, under a different OS account, and verify the chain from somewhere else.
8. Keep records at least 6 months after the session closes (12 months recommended for EU AI Act high-risk systems), and handle erasure requests with signed tombstone records rather than deleting entries.

What fields does every IETF Agent Audit Trail record have to contain?

The draft splits fields into mandatory and optional. The mandatory set answers who acted (agent_id, agent_version), for whom (principal), in what context (session_id, trust_level), what happened (action_type, action_detail, outcome), when (timestamp, record_phase) and where the record sits in the chain (parent_record_id, prev_hash). Optional fields cover human overrides, recording component, signer key id, content fingerprints and decision-reproducibility digests.

• The principal field is the newest mandatory addition. It records the immediate authorizing party, and for agent-to-agent delegation each hop gets its own delegation record so the full chain of authority can be rebuilt. Archives written under -06 or earlier won't have it, and verifiers are told to treat that as "principal not recorded", not as an invalid record.
• The draft maps the format informatively to EU AI Act Articles 12 and 19, SOC 2, ISO/IEC 42001, the draft ISO/IEC 24970 and prEN 18229-1 logging standards and PCI DSS v4.0.1, and notes that the AI Act's high-risk application dates were moved into 2027 and 2028. Following the format doesn't by itself make a system compliant with any of them.

Why does the Agent Audit Trail draft require some records to be written before the agent acts?

Revision -00 didn't require a record at the moment of authorization, and the draft now names the gap: a log written after the fact can be perfectly well formed and still give no evidence that a policy check stopped anything. record_phase closes it by stating when each record was written.

• A pre_execution record with outcome denied shows the action was evaluated and refused before it ran; one with outcome success shows an authorization decision existed before execution. A post_execution record shows what happened but can't show that a gate was in place beforehand. concurrent is for long-running or streaming actions.
• For actions that matter, expect two records: the authorization decision before, and the result after, sharing the same action_detail or linked through an authorization_record_id.

Should an AI agent write its own audit log, and what does a hash-chained log prove?

At trust levels L0 and L1 an agent may log itself, but must say so, and the draft is plain that self-recording is weaker evidence because the agent could leave things out. From L2 up, records should come from a gateway, sidecar or external monitor that signs with its own key, kept where the agent can't reach it. The draft also warns that if the agent's operator assigns trust levels, it can avoid independent recording by labelling consequential actions L0 or L1, so downgrades must themselves be recorded.

• The hash chain shows records weren't altered or removed after the fact, and optional signatures, external timestamps and Merkle anchoring make that easier to check. The draft is careful about what this doesn't prove: a recorder that both writes and signs can still log an event that never happened or skip one that did, which is why it wants independent recorders and outside verification.
• It also separates record reproducibility, which any agent can offer by letting others recompute the chain, from decision reproducibility, which needs open weights, temperature zero and an attested environment with every component digested. A decision that is only recorded should be called reconstructable, not reproducible.