{
  "question": "We're designing the audit log for our AI agents and keep seeing the IETF Agent Audit Trail draft mentioned. What does it require in each log record, why does it want some records written before the agent acts, and is it actually a standard yet?",
  "slug": "what-does-the-ietf-agent-audit-trail-draft-require-in-each-ai-agent-log-record",
  "url": "https://www.rightshold.com/answers/what-does-the-ietf-agent-audit-trail-draft-require-in-each-ai-agent-log-record",
  "short_answer": "The Agent Audit Trail (AAT) draft, now at revision -09 (October 26, 2026), defines a JSON record for every agent action with mandatory fields: a UUIDv4 record_id, an RFC 3339 timestamp, a persistent agent_id URI, a principal naming who the agent acted for (type, id and a reference to the grant or delegation, added in -07), agent_version, session_id, action_type (tool_call, tool_response, decision, delegation, escalation, error, lifecycle), action_detail, outcome (success, failure, timeout, denied, escalated), trust_level (L0 to L4), parent_record_id, prev_hash (SHA-256 of the previous record canonicalized per RFC 8785) and record_phase. record_phase says whether the record was written before, during or after the action: denials and escalations must be written before execution, because a denial logged afterwards proves nothing was actually stopped. Raw inputs and outputs must not go in the log, only their hashes. It is an individual Internet-Draft, not adopted by an IETF working group and not a standard; it expires April 29, 2027 unless revised.",
  "checklist": [
    "Give every record a fresh UUIDv4, a UTC timestamp with milliseconds, a persistent agent_id URI and the semantic version of the agent software.",
    "Name the principal on every record: whether a human, organization, service or agent authorized it, a pseudonymous or role-based id for a person, and authority_ref pointing to the grant, delegation record or token it relied on (null, with the basis explained, if there isn't one).",
    "Write the decision record before the action runs whenever the agent is stopped or sent to a human. The draft makes pre_execution mandatory for denied and escalated decisions and denied delegations.",
    "For high-risk systems under the EU AI Act, write a pre-execution authorization record before any action that changes external state, moves money or delegates, and a post-execution record of the result that links back to it.",
    "Chain the records: each carries the previous record's id and the SHA-256 of its RFC 8785 canonical JSON, so a deleted or edited record breaks verification.",
    "Hash, don't store, prompts, outputs, tool parameters and reasoning. Keep raw data in a separate access-controlled system linked by record_id.",
    "Above trust level L1, have a component outside the agent write and sign the records with its own key, under a different OS account, and verify the chain from somewhere else.",
    "Keep records at least 6 months after the session closes (12 months recommended for EU AI Act high-risk systems), and handle erasure requests with signed tombstone records rather than deleting entries."
  ],
  "sections": [
    {
      "heading": "What every Agent Audit Trail record must contain",
      "points": [
        "The draft splits fields into mandatory and optional. The mandatory set answers who acted (agent_id, agent_version), for whom (principal), in what context (session_id, trust_level), what happened (action_type, action_detail, outcome), when (timestamp, record_phase) and where the record sits in the chain (parent_record_id, prev_hash). Optional fields cover human overrides, recording component, signer key id, content fingerprints and decision-reproducibility digests.",
        "The principal field is the newest mandatory addition. It records the immediate authorizing party, and for agent-to-agent delegation each hop gets its own delegation record so the full chain of authority can be rebuilt. Archives written under -06 or earlier won't have it, and verifiers are told to treat that as \"principal not recorded\", not as an invalid record.",
        "The draft maps the format informatively to EU AI Act Articles 12 and 19, SOC 2, ISO/IEC 42001, the draft ISO/IEC 24970 and prEN 18229-1 logging standards and PCI DSS v4.0.1, and notes that the AI Act's high-risk application dates were moved into 2027 and 2028. Following the format doesn't by itself make a system compliant with any of them."
      ]
    },
    {
      "heading": "Why the draft insists on pre-execution records",
      "points": [
        "Revision -00 didn't require a record at the moment of authorization, and the draft now names the gap: a log written after the fact can be perfectly well formed and still give no evidence that a policy check stopped anything. record_phase closes it by stating when each record was written.",
        "A pre_execution record with outcome denied shows the action was evaluated and refused before it ran; one with outcome success shows an authorization decision existed before execution. A post_execution record shows what happened but can't show that a gate was in place beforehand. concurrent is for long-running or streaming actions.",
        "For actions that matter, expect two records: the authorization decision before, and the result after, sharing the same action_detail or linked through an authorization_record_id."
      ]
    },
    {
      "heading": "Who should write the log, and what the hash chain proves",
      "points": [
        "At trust levels L0 and L1 an agent may log itself, but must say so, and the draft is plain that self-recording is weaker evidence because the agent could leave things out. From L2 up, records should come from a gateway, sidecar or external monitor that signs with its own key, kept where the agent can't reach it. The draft also warns that if the agent's operator assigns trust levels, it can avoid independent recording by labelling consequential actions L0 or L1, so downgrades must themselves be recorded.",
        "The hash chain shows records weren't altered or removed after the fact, and optional signatures, external timestamps and Merkle anchoring make that easier to check. The draft is careful about what this doesn't prove: a recorder that both writes and signs can still log an event that never happened or skip one that did, which is why it wants independent recorders and outside verification.",
        "It also separates record reproducibility, which any agent can offer by letting others recompute the chain, from decision reproducibility, which needs open weights, temperature zero and an attested environment with every component digested. A decision that is only recorded should be called reconstructable, not reproducible."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before our refunds agent issues a refund, record the pre-execution authorization decision: which agent and version, the principal and the grant it acted under, and a hash of the full AAT-style record we keep, with no customer details, so we can show the gate ran before the money moved.",
    "mcp_call": {
      "tool": "record_action",
      "arguments": {
        "action_type": "agent.decision.pre_execution",
        "outcome": "success",
        "occurred_at": "2026-11-13T16:45:00Z",
        "client_event_id": "refund-agent:dec-2026-11-13-0117",
        "summary": "record_phase pre_execution; agent urn:agent:refunds.example v3.2.0; principal organization urn:org:support-ops, authority_ref grant G-REF-22 (refunds up to 100 USD); action_type decision for tool_call payments.refund; authorized to proceed; post-execution record to reference this client_event_id",
        "action_sha256": "<sha256 of the RFC 8785 canonical JSON of your full AAT record>"
      }
    },
    "also": [
      "Needs your API key (or accept_terms:true once to open a free account; the key comes back once). It returns a ledger-committed receipt of what was submitted and when, kept outside your agent's own log.",
      "Send the pre-execution decision and the post-execution result as separate calls, each with its own client_event_id, so a retry doesn't create a second entry.",
      "Keep customer names, account numbers and raw prompts out of summary; the hash ties the receipt to the full record in your store.",
      "It doesn't validate records against the AAT draft, verify your hash chain or assign trust levels, and it proves the entry was submitted, not that the refund happened as described."
    ],
    "scope": "Rightshold isn't affiliated with the IETF or the draft's author, and its ledger isn't an implementation of the AAT format. Details are from draft-sharif-agent-audit-trail-09 (October 26, 2026) and its datatracker page, read November 13, 2026. Internet-Drafts are works in progress that can change or lapse at any time, and this one is an individual submission, not an IETF standard or working-group document. Not legal or compliance advice."
  },
  "sources": [
    {
      "title": "IETF: draft-sharif-agent-audit-trail-09, Agent Audit Trail: A Standard Logging Format for Autonomous AI Systems (October 26, 2026)",
      "url": "https://www.ietf.org/archive/id/draft-sharif-agent-audit-trail-09.txt"
    },
    {
      "title": "IETF Datatracker: draft-sharif-agent-audit-trail (status and revision history)",
      "url": "https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/"
    },
    {
      "title": "IETF: RFC 8785, JSON Canonicalization Scheme (JCS)",
      "url": "https://www.rfc-editor.org/rfc/rfc8785"
    },
    {
      "title": "Verified AI Runs on Rightshold",
      "url": "https://www.rightshold.com/verified-ai-runs"
    }
  ],
  "related": [
    {
      "title": "How to log every AI agent tool call for audit",
      "url": "https://www.rightshold.com/answers/how-to-log-every-ai-agent-tool-call-for-audit"
    },
    {
      "title": "How to audit which human authorized an AI agent action",
      "url": "https://www.rightshold.com/answers/how-to-audit-which-human-authorized-an-ai-agent-action"
    },
    {
      "title": "How to make an AI agent's audit log append-only so even an admin can't silently delete entries",
      "url": "https://www.rightshold.com/answers/how-to-make-an-ai-agents-audit-log-append-only-so-even-an-admin-cant-silently-delete-entries"
    },
    {
      "title": "How to honor a GDPR erasure request when an AI agent's audit log is tamper-evident",
      "url": "https://www.rightshold.com/answers/how-to-honor-a-gdpr-erasure-request-when-an-ai-agents-audit-log-is-tamper-evident"
    },
    {
      "title": "How long do you have to keep AI agent logs under the EU AI Act?",
      "url": "https://www.rightshold.com/answers/how-long-do-you-have-to-keep-ai-agent-logs-under-the-eu-ai-act"
    },
    {
      "title": "What records does the HKMA expect banks to keep for each AI agent?",
      "url": "https://www.rightshold.com/answers/what-records-does-the-hkma-expect-banks-to-keep-for-each-ai-agent"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-13"
}