IETF draft standard for AI audit trails

You must now record execution facts, evidence relations and reasoning provenance separately from your audit trail, because a hash-chained log alone cannot prove why an autonomous agent acted or that authorisation checks took place before the action.

An analysis of 5 October 2026 of hash-chained audit trail formats for autonomous AI agents argues that a working IETF Internet-Draft proposes a JSON-based standard for recording agent actions, but that reliable reconstruction requires you to organise three separate recording layers. The draft describes a fixed format capturing which agent, under which version and with which authorisation, carried out an action. In our assessment, the proposal signals a substantive shift from mutable observability to auditable execution evidence, but because the document remains a working draft and not an adopted standard, adoption is a governance choice rather than compliance with an established requirement.

What does pre-execution recording prove that post-execution recording does not?

A record written before an action demonstrates that an authorisation or policy check existed while it could still intervene. A record written afterwards cannot prove that the check took place at all—only that someone documented what happened. This distinction is why the draft standard insists on independent recording before the action. For a lawyer reviewing whether an agent acted within mandate, a pre-action authorisation record with agent version and model identity carries stronger evidential weight. You should therefore include in supplier contracts a requirement that pre-action authorisation records be delivered as part of the audit trail, not as an optional enhancement.

Which three reconstruction levels must you maintain separately?

Academic literature on evidence tracing identifies three complementary layers that do not follow from a single log:

• Execution traces — what the agent did, when, and which tools or data it accessed.
• Evidence relations — which external system responded to which request, and what the agent received in return.
• Reasoning provenance — why the agent chose a particular action, including intent, plan changes and delegation chains.

Whoever keeps only existing traces can technically replay a session without ever demonstrating why the agent chose its course. That gap must be recorded separately, or it does not exist. A CISO assessing a high-risk autonomous workflow must now decide which of these three levels to keep, instead of assuming that one system covers everything.

What does hash chaining detect, and what does it not?

Hash chaining proves that records have not been altered after they were written. It does not prove that the recorder captured all events. An incomplete chain that is internally consistent looks reliable and is not. Because an independent recorder outside the agent process is central in the draft standard, a log file that the agent keeps about itself can lose its evidential value as soon as that agent fails or is manipulated. You should assess, per autonomous workflow, whether the recording should be physically and organisationally separated from the system it records.

What controls must you demonstrate to account for an autonomous action later?

1. Record the agent version and model identity — document which model each workflow uses and which version was active when the action occurred.
2. Capture pre-action authorisation — record that a policy or authorisation check took place before the agent acted, not afterwards.
3. Log data and tool access separately — maintain a distinct record of which external systems the agent contacted and what responses it received.
4. Document reasoning provenance — record intent, plan changes, human escalations and interruptions so that the decision chain is auditable.
5. Perform periodic integrity and completeness checks — verify that the hash chain is complete and that no crucial events were omitted, as a standing control rather than a one-off acceptance test.

Tooling can enforce the format and detect tampering, but the choice of what to record and how to separate these layers remains your own professional judgement. No standard, working draft or otherwise, can replace the decision about which autonomous workflows warrant which level of evidential rigour.