{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/log-what-the-agent-did-not-only-what-it-said",
  "id": "MHC-D-RESEARCH-0317",
  "version": "0.1.0",
  "title": "Log what the agent did, not only what it said",
  "summary": "The chat transcript is not the audit trail if the real effects happened elsewhere.",
  "kind": "checklist",
  "body": "Record the consequential tool call, bounded arguments, authorization context, result and downstream effect needed for review. Link actions to the initiating request and approval where relevant. Keep the log inspectable without copying sensitive payloads that are unnecessary for diagnosis.",
  "limits": [
    "Logging creates its own privacy and security obligations; collect only what is needed and protect access."
  ],
  "topics": [
    "union-ai-agent-control"
  ],
  "intents": [],
  "source_ids": [
    "RS-EEEBBCF69A614717"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends logging and monitoring agent-extension and downstream activity to detect undesirable actions.",
      "source_id": "RS-EEEBBCF69A614717",
      "role": "supports",
      "note": "Logs should avoid unnecessary sensitive content and need retention and access controls of their own.",
      "locator": "Damage-limitation controls: log and monitor activity"
    }
  ],
  "use_when": [
    "An agent can take actions through tools and failures need to be investigated or contained."
  ],
  "avoid_when": [
    "Logging creates its own privacy and security obligations; collect only what is needed and protect access."
  ],
  "example": "For a repository agent, keep the PR or commit IDs it created, not just 'Done' in the conversation.",
  "check": "After a failure, you can identify which external actions occurred and which did not.",
  "checklist": [
    "The initiating request or workflow run can be identified.",
    "Each consequential tool call has a timestamp and result.",
    "Relevant authorization and approval context is traceable.",
    "Sensitive payloads are minimized or redacted according to policy.",
    "Downstream effects can be reconciled with the tool record."
  ],
  "sources": [
    {
      "id": "RS-EEEBBCF69A614717",
      "title": "LLM06:2025 Excessive Agency",
      "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/"
    }
  ],
  "relations": [],
  "collections": [
    {
      "id": "RC-EEF5F4530C11FD17",
      "title": "Let AI do useful work without giving it accidental authority",
      "url": "/collections/let-ai-do-useful-work-without-giving-it-accidental-authority"
    }
  ]
}