Failure pattern · 9 documented incidents

Audit trail missing actor, target or decision

After something goes wrong nobody can tell who or what took the action, on which object, or why.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

Who did it, to what, and why? Nobody can tell.

What goes wrong:

  1. A person, an AI agent and a script all use one shared account.
  2. One of them deletes 4,000 customer records.
  3. The log records only the shared account and the word “delete”.
  4. Who did it, to what, and why? Nobody can tell.

With the safeguard:

  1. Every person, agent and job has its own identity.
  2. The agent deletes 4,000 records while working a ticket.
  3. The log keeps the actor, the target and the reason, and cannot be edited.
  4. The investigation takes minutes, not weeks.

What it is

Something goes wrong and nobody can say who did it, what exactly was touched, or why. Shared accounts, thin logs and missing context turn a short investigation into a long, expensive guess.

How it happens

  • People, scripts and AI agents share credentials
  • Logs record that something happened, but not by whom or to what
  • The reason for an action (a ticket, an approval) is never recorded

What it causes

  • Investigations that take weeks instead of hours
  • Incomplete breach notifications and regulatory trouble
  • Attackers who stay hidden because their actions look normal

Warning signs

  • Log entries that only name a shared service account
  • No way to list everything one actor did yesterday
  • Teams arguing about what happened from memory

How to prevent it

Log every consequential decision with full context. Record the actor (human, service or agent), target, inputs, decision and outcome for each consequential action in tamper-evident logs, and alert on unusual access.

  • Every person, service and AI agent acts under its own identity
  • Each consequential action logs who did it, to what, and why
  • Audit logs are append-only and kept where the actors they record can’t edit them

Key ideas:Audit trail

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
Documented incidentIncident 2022-08-04

SMS phishing of employees leads to compromise of Twilio customer accounts (2022)

Attackers used SMS phishing to fool some Twilio employees into giving up credentials, then used them to access internal systems and information about a limited number of customer accounts.

Safeguard: Use phishing-resistant MFA for employees

Weak or phishable authentication on a privileged pathtwilio.com
27 security advisories and illustrative scenarios with this pattern

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.