Stop logging just "events" and start logging claims with evidence.
Most people debug AI agents by printing a trace like [INFO] Tool called: database_delete. That's useless for proving correctness or auditing security because it just tells you what the agent tried to do, not why it was allowed or what data it used. If a customer, a regulator, or your own team asks "why did your agent do that?", an event trace has no answer. Here are three concrete ways to actually prove your agent behaved correctly:
Log claims, not actions¶
Instead of tool called X, log the specific policy claim the agent made, backed by evidence. For example: agent claimed permission to modify user record (claim_id: 42), evidence: grant_record_id: #8942, state_hash: a1b2c3. The discipline is simple and brutal: if you can't point to the exact evidence record, the action shouldn't happen. Every consequential action leaves a pointer to the record that authorized it.
Hash-link your audit trail¶
Chain every log entry to the previous one using cryptographic hashing, the way git chains commits. If entry #5 includes the hash of entry #4, nobody — not even an admin with database access — can silently alter, delete, or reorder the logs after the fact without breaking the entire chain. Tamper-evidence is mandatory if you need real accountability. An audit trail that can be edited after the fact is a diary, not evidence.
Log the rejections just as loudly¶
A massive red flag in agent logs is a pristine trail of only successful actions. You need to log blocked and rejected attempts too. Seeing "agent attempted unauthorized delete, blocked by policy boundary X" proves your safety guards are actually doing their job and the boundary held under fire. The rejection record is the part of the trail that proves the rest of the trail is honest.
These patterns are covered in depth in Section 6 of the Governed Agent Mesh Playbook: claim-evidenced, hash-linked audit trails designed for debugging and accountability, not just compliance theater.