Checklist
Log what the agent did, not only what it said
The chat transcript is not the audit trail if the real effects happened elsewhere.
When it fits
- An agent can take actions through tools and failures need to be investigated or contained.
When to avoid it
- Logging creates its own privacy and security obligations; collect only what is needed and protect access.
Checklist
- The initiating request or workflow run can be identified.
- Each consequential tool call has a timestamp and result.
- Relevant authorization and approval context is traceable.
- Sensitive payloads are minimized or redacted according to policy.
- Downstream effects can be reconciled with the tool record.
Why it matters
Record the consequential tool call, bounded arguments, authorization context, result and downstream effect needed for review. Link actions to the initiating request and approval where relevant. Keep the log inspectable without copying sensitive payloads that are unnecessary for diagnosis.
An example
For a repository agent, keep the PR or commit IDs it created, not just 'Done' in the conversation.
Check your result
After a failure, you can identify which external actions occurred and which did not.
Keep this limit in mind
- Logging creates its own privacy and security obligations; collect only what is needed and protect access.
Evidence and sources
Supports
OWASP recommends logging and monitoring agent-extension and downstream activity to detect undesirable actions.
Logs should avoid unnecessary sensitive content and need retention and access controls of their own.
LLM06:2025 Excessive Agency · Damage-limitation controls: log and monitor activity