Glossary
Audit trail
A tamper-resistant record of who did what, to which object, when and why, used to investigate incidents and prove compliance.
Also called Audit log.
In plain terms
When something goes wrong, the first questions are who, what and why. A good audit trail answers all three in minutes. A poor one records a shared account name and leaves you guessing for weeks.
It matters more as AI agents act on people’s behalf. Each agent needs its own identity, and each action needs the reason behind it, such as the ticket or approval that started it.
See what happens without it
The failure pattern this protects against, audit trail missing actor, target or decision, played out step by step.
Scroll the diagram sideways to see every system.
Who did it, to what, and why? Nobody can tell.
What goes wrong:
- A person, an AI agent and a script all use one shared account.
- One of them deletes 4,000 customer records.
- The log records only the shared account and the word “delete”.
- Who did it, to what, and why? Nobody can tell.
With the safeguard:
- Every person, agent and job has its own identity.
- The agent deletes 4,000 records while working a ticket.
- The log keeps the actor, the target and the reason, and cannot be edited.
- The investigation takes minutes, not weeks.
When it mattered
In 2023 an attacker used a stolen credential to take files from Okta’s support system, including HAR files holding live session tokens. Over the following weeks, Okta’s estimate of who was affected grew from under 1% of customers to every support-system user.