What is AI agent auditability?

AI agent auditability is the ability to reconstruct, for any decision an agent made, what was decided, under whose authority, against which limits, with what outcome, and which human was involved if any. It is the property that lets an auditor, regulator, board, or incident responder get a real answer instead of "the agent did it."

An action log is not an audit trail

Every system agents touch already produces logs. The payments API logs that a refund was issued by a given token at a given time. The cloud provider logs that an instance was resized. These are records of actions. They answer what happened.

They do not answer whether it was authorized. The log shows a refund of a certain amount. It does not show that the refund policy allowed that amount, that it was the fourteenth refund of the day against a ceiling of twenty, that the account was not flagged, and that the support director owns the policy under which it was permitted. Reconstructing that after the fact from action logs is somewhere between expensive and impossible, because the information was never captured.

When an investigation runs on action logs alone, it ends at the identity. The token belonged to the agent. The agent was deployed by a team. Nobody in that chain decided anything, and nobody can say whether the decision was inside authority, because authority was never written down.

What a decision record contains

Our position is that auditability for agents requires a record per decision, separate from the application log, with at least the following.

The agent and the delegation chain behind it, including the human at its root.

The proposed action with its parameters.

The decision rights that applied: which policy, which version, who owns it.

The constraints that applied: per-action thresholds, and the cumulative ceiling with its state at the time of the decision.

The outcome: allow, constrain, escalate, or deny, and the reason.

Any human involvement: who the decision was escalated to, what they decided, and when.

Tamper evidence, so the record can be trusted by someone who does not trust the system that produced it.

This is a record of authority, not a record of activity. It answers who authorized this decision and on what basis, which is the question auditors and regulators actually ask.

Auditability for agents that were never registered

An audit trail that only covers registered agents has a gap exactly where the risk is highest. If the decision record is produced by the enforcement point in the action path, then any agent whose action passed through that point is in the record, whether or not anyone knew it existed. The unregistered agent that tried to issue a refund and was denied is in the ledger, with the reason.

Event-only mode as an audit tool

A decision record can be produced without enforcement. Every action is evaluated and the outcome that would have applied is recorded, but nothing is blocked. For an organization that does not yet know what its agents are doing, this produces the first honest picture: here is what agents decided, here is what the intended authority was, here is the gap. It is also the fastest way to answer an auditor's question about agent decisions before enforcement is in place.

Where BotAris fits

The Accountability Ledger is BotAris's decision record. Every allow, constrain, escalate, and deny produces an entry with the agent, the chain, the proposed action, the decision rights and constraints that applied, the outcome, and any human escalation or override. Entries are tamper-evident. It is built to answer an auditor, not to replace application logging.