What is the difference between an AI agent audit trail and a log?

A log is written by the system being watched, in whatever form that system chooses, and the agent or its operator can usually edit or delete it. An audit trail is built for a reader who does not trust the writer: entries are produced at execution time by the platform that ran the call, each saved result is committed under a hash fixed at that moment, and the record is kept where the agent cannot rewrite it. The practical test is simple. If the thing that acted can also change the record of the act, you have a log. If it cannot, and a stranger can recompute the record and get the same answer, you have an audit trail.

Audit trail

What is an AI agent audit trail? A record of the work that someone else can check.

Q: Can an AI agent edit or delete its own audit trail?

Not when the trail is kept the way Zambo keeps it. The agent requests a tool call; the platform executes it and writes the receipt itself, commits the saved result under a SHA-256 hash at execution time, and publishes the record at a stable public URL. The agent never holds the pen, so it cannot edit an entry afterward, and an edit made by anyone else fails the recompute: decode the receipt's canonical bytes, hash them, and the result no longer matches the committed hash. A missing entry is visible the same way, because the trail is a public stream anyone can read.

An AI agent audit trail is the ordered record of what an agent actually did: each tool call, its inputs, its observed result, and the time it ran, kept in a form a second party can inspect and recompute. It differs from a log in the one way that matters. A log is written by the system being watched. An audit trail is produced by the platform as the work executes, each entry committed under a hash at the moment it is written, in a place the agent cannot rewrite. This page opens one real entry from today and checks it end to end.

Worked example: one entry from today's trail, recomputed

On November 4, 2026, at 07:43:43 UTC, an agent ran a scam_check call through Zambo and the platform wrote receipt 06273ebe-6270-4208-a739-c8831c8e957e as the call executed. Its saved result is committed under output_hash sha256:837342678ea45d03153e733d54e24ede7004580f649916c5290e5ed7255e5dff. The check is one computation: decode the receipt's canonical bytes, run SHA-256 over the exact decoded bytes, and compare. The recomputed hash matches the committed hash exactly, and the public verification endpoint reports the same result, with its commitment, canonical payload, provenance binding, and metadata binding checks all passing and a verification status of verified. Run it yourself at the receipt's verify endpoint, no account, no token. That entry is one of 6,240 receipts issued on November 3 alone, on a public record that passed 106,000 receipts this morning and keeps growing in the open, at a pace anyone can watch on zambo.dev/numbers.

What belongs in an audit trail

One entry per tool call, not per conversation. The unit of agent work is the call: the tool that ran, the arguments it received, and the result the system observed. A trail of chat summaries cannot be audited; a trail of calls can.
The observed result, saved at execution time. Not the agent's description of the result written later, but the bytes the call actually returned, saved as it ran.
A commitment over those bytes. Each entry carries a SHA-256 hash of its saved result, fixed at the moment of the call. Change one byte later and the recompute disagrees, in public.
Time and provenance. When the call ran, which tool ran it, and in what capacity. An entry that cannot say when it happened and who produced it is an anecdote.
A stable place a stranger can read. Every entry resolves at a public URL and can be checked with no account, so the reader never has to ask the writer for permission to audit.

Audit trail, log, transcript: three different objects

A transcript is what the agent said. It is testimony, written by the party whose work is in question, and it can be edited by re-running the conversation. A log is what the system recorded for its own operators: useful for debugging, usually kept where the agent or its operator can rotate, edit, or delete it, and written in whatever form the system found convenient. An audit trail is the record built for a reader who trusts neither: produced by the executing platform at the moment of the call, committed under a hash, and readable and recomputable by anyone. The test that separates them is one question. Can the thing that acted also change the record of the act? If yes, you are reading a story. If no, and the recompute is public, you are reading an audit trail.

How an audit trail entry is checked

Open the entry. Every Zambo receipt resolves at zambo.dev/run/ plus its id, with its full record at the receipt API, no login.
Recompute the hash. Decode the canonical_bytes field, compute SHA-256 over the exact decoded bytes, and compare with the entry's output_hash. A match proves the saved result was not changed since the call ran.
Check the binding fields. Read the provenance_class, the created_at timestamp, and the metadata_hash when present. This is the Section 6 verification procedure of draft-zambo-aer1-26, the open format the entries are written in, designed so a stranger can run the same check and get the same answer.
Then read the work. With the record settled as intact, judge what the agent actually did. That judgment was impossible while the only record was the agent's own summary.

What an audit trail proves, and what it does not

It proves the saved record of each call was not changed after the call ran, which settles what the agent did as recorded: which tools, which inputs, which observed results, in which order. It does not prove the results were correct. A faithfully recorded bad answer is still a bad answer, and the trail is what lets you find it. Anyone who sells you a stronger claim than that is selling you a story about a record instead of the record. Zambo is the verifiable work layer for AI: the trail exists so that done is a check, not a claim.

Get an audit trail for your agent's work

Work that already ran with no record underneath it cannot be audited after the fact. Run the next job through Zambo and the trail is written by the run itself: connect any MCP-capable AI at zambo.dev/add (20 calls and 1 wrap-up free every day, no account; picking up in another AI is always free), and every call through https://zambo.dev/mcp leaves its verifiable receipt as it executes. For the full treatment, including trails that survive the agent itself, read the complete guide to AI agent audit trails, the audit trail your agent cannot delete, and how to audit what your agent did after the session.

Questions, answered

What is an AI agent audit trail?

The ordered record of what an agent actually did: each tool call, its inputs, its observed result, and the time it ran, kept in a form a second party can inspect and recompute. On Zambo the platform writes each entry as the call executes and commits its saved result under a SHA-256 hash, so the trail can be checked by anyone, entry by entry, without trusting the agent or the platform's summary of it.

What is the difference between an audit trail and a log?

Who can change it, and who it is written for. A log is written by the system being watched, for its own operators, and can usually be edited or deleted by the agent or its operator. An audit trail is written for a reader who does not trust the writer: produced at execution time, committed under a hash, and kept where the agent cannot rewrite it.

Can an AI agent edit or delete its own audit trail?

Not when the platform writes the entries. The agent asks for a call; the platform executes it and writes the receipt itself. An edit by anyone afterward fails the public recompute, and a deleted entry leaves a visible hole in a stream anyone can read.