[ PROVE / AUDIT_TRAIL ]

What is an AI agent audit trail?

An AI agent audit trail is a bitemporal, cryptographically signed record of every action an agent took, sufficient to stand up in a regulatory audit or a court. Centurian generates one per agent regardless of which vendor built it.

Why a screenshot or a log line isn’t evidence

A screenshot can be staged. A CloudWatch log can be edited or deleted. Neither carries a cryptographic guarantee that what you're looking at is what actually happened, in the order it happened. An audit trail built for regulatory or legal defensibility needs two properties a plain log doesn't have: bitemporal structure (valid time, when the action happened, plus transaction time, when it was recorded) and a signature that makes tampering detectable.

Centurian writes every agent action as a bitemporal row with an Ed25519 signature, append-only at the spine layer, a deletion is a separate signed event, not a silent removal. Targeted-deep audits sample rows at random; if any sampled row fails verification, the audit aborts and the operator is alerted rather than the report shipping with a gap nobody noticed.

The accountability gap this closes

67% of CIOs and CTOs report being accountable for AI systems they do not fully control (IBM Institute for Business Value, n=2,000, fielded January-April 2026), and the average organization logs 54 agent incidents per year. That gap between accountability and control is exactly where an audit trail earns its keep: it turns "I'm responsible for this agent" into "here is precisely what this agent did, signed and timestamped."

One audit trail covers every vendor an org runs, Salesforce Agentforce, AWS Bedrock, Microsoft Foundry, Google Vertex, Copilot Studio, custom code, because most enterprises run agents on six or more platforms and a report that only covers one is not a compliance report, it's a subset. The EU AI Act runway to December 2, 2027 rewards starting this evidence chain now, not the month the obligation binds. See proving AI agent compliance for how the audit trail becomes a signed compliance artifact.

FAQ

What is an AI agent audit trail?

Why does an audit trail need to be bitemporal?

Bitemporal means every row carries both valid time (when the action actually happened) and transaction time (when the system recorded it). That distinction matters when an agent's action is disputed, corrected, or reviewed after the fact, a plain timestamp can't show whether a record was backfilled or altered after the fact, but a bitemporal, signed row can.

Who is actually asking for this evidence?

67% of CIOs and CTOs report being accountable for AI systems they do not fully control (IBM Institute for Business Value, n=2,000, fielded Jan-Apr 2026), and the average org logs 54 agent incidents per year. Regulators, auditors, boards, and customers are all downstream of that accountability gap, an audit trail is what turns 'I'm accountable for it' into 'I can show you exactly what it did.'

Does the audit trail cover agents from every vendor?

Yes. Agents on Salesforce Agentforce, AWS Bedrock, Microsoft Foundry, Google Vertex, Copilot Studio, and custom code all write to the same bitemporal spine. That matters because most enterprises run agents on six or more platforms, and a compliance report that only covers one vendor's agents doesn't satisfy a regulator asking about the whole fleet.

How does this relate to the EU AI Act deadline?

EU AI Act Annex III high-risk obligations take effect December 2, 2027, after the 2026-05-07 Digital Omnibus deferral (Annex I embedded systems: August 2, 2028). An audit trail that starts accumulating history now, well ahead of that date, is worth more at audit time than one assembled the month the obligation binds, evidence with a track record is what an auditor actually trusts.

Get early access →

First agent free, forever · No credit card