How to audit AI agent tool calls so the record cannot rewrite itself

The best way to audit AI agent tool calls is to stop auditing the agent's account of itself. Logs and transcripts are written by the system being audited. A verifiable receipt is fixed at the moment of execution and committed under a digest, so anyone can rerun the audit later against a record that cannot quietly change.

Try the audit yourself in one click: the live demo runs a real call and hands you its receipt in about a second, no signup. Recompute it, reopen it, hand the link to someone else and let them check it.

Published October 14, 2026. Updated October 15, 2026. Written against draft-zambo-aer1-23.

Why auditing an AI agent is not like auditing normal software

A normal program either throws an error or it does not. An AI agent can fail quietly: a tool call returns nothing, a step is skipped, a number is invented to fill a gap, and the final summary still reads like success. The audit question is therefore not "did it crash." It is "can anyone prove, later, exactly what ran, what it was given, and what it produced."

Most teams try to answer that with logs and transcripts. Both are written by the same system being audited, and both can be edited, regenerated, or summarized after the fact. A record the audited system can rewrite is a claim, not evidence.

What an audit trail for AI agents should include

For every tool call that matters, the trail should fix five things at the moment of execution, not afterward:

  1. Which tool ran, and in which job or workflow it ran.
  2. The exact inputs the tool was given.
  3. The exact output it produced, saved byte for byte.
  4. When it ran, in order relative to the other steps.
  5. A SHA-256 digest committed over the record, so any later change to the saved result breaks the digest and becomes visible.

If any one of those is missing, the audit has a hole exactly where a failure can hide: an unrecorded input, a summarized output, a step with no place in the sequence.

How to run an AI agent tool call audit, step by step

  1. Pick the job, not the summary. Start from one specific run you need to stand behind.
  2. Ask for the receipt for that job. Each receipt links the tool, its inputs, and its saved result into one record.
  3. Recompute the digest yourself, or open the public verification page and let it recompute for you. A match means the saved result is the result that was committed at execution time.
  4. Compare the saved result against the deliverable you actually received. The receipt fixes the record; your comparison judges the work.
  5. For multi-step jobs, audit the workflow record, not only the last step. A sealed workflow binds the step receipts into one run record, so a missing or swapped step shows up.
  6. Keep the receipt link with the deliverable. Anyone you hand both to can repeat the audit without asking you or the agent.

The method in brief is the same one the practical audit walkthrough steps through call by call, and the AI agent audit trail explainer covers the trail as a whole.

What a receipt proves, and what it does not

A verifiable execution receipt proves the saved result was not changed after the fact. It does not prove the answer was right. That limit is a feature: the audit stops being an argument about whose summary to trust and becomes a check anyone can rerun against a fixed record.

Keep the claim narrow, because narrow is what makes it checkable. A receipt proves the saved result was not changed since it was saved. Correctness still has to be judged separately, against the deliverable itself.

Zambo issues a receipt for every job run through it, checkable by anyone at zambo.dev/verify/. The format is AER-1, published as an IETF Internet-Draft (draft-zambo-aer1-23), so the audit trail stays readable outside any one product. Ask for a zambo receipt the way you would ask for a receipt for anything else you paid for. A Day Pass ($0.99) keeps a full day of runs receipted.

AI agent audit trail: FAQ

What is an AI agent audit trail?

It is the fixed, checkable record of what an agent did: the tools it called, the inputs it used, the outputs it produced, and the order they happened in, committed at execution time so it cannot be quietly rewritten later.

How do I audit an AI agent after something went wrong?

Start from the receipt for the failed job, not from the agent's explanation. Verify the digest, compare the saved inputs and output against what should have happened, then walk the workflow record to find the step where the run left the rails. If the run left no receipt, there is nothing fixed to audit, and that absence is itself the finding.

What should an audit trail for AI agents include?

For every tool call that matters, five things fixed at the moment of execution: which tool ran and in which job, the exact inputs it was given, the exact output saved byte for byte, when it ran in order relative to the other steps, and a SHA-256 digest committed over the record so any later change breaks the digest and becomes visible.

Related