How to Audit and Log AI Agent Actions for Compliance
NOFire AI
How do I record or audit what AI coding agents like Claude Code and Cursor do?
Record four things for every agent action: the intent (what the agent was asked to do), the context it acted on, the authorization that allowed it, and the effect it had. Write that record outside the agent, because an agent's own transcript is a claim by the thing being audited. NOFire AI signs each action and policy verdict outside the agent and exports it to the SIEM you already audit.
VerdictAsk who wrote the log before asking what is in it. A record the agent could have edited is useful for debugging and worth nothing to an auditor.
Before you start
Auditing an AI agent means being able to show, for any window someone else chooses, every action the agent took, why it was allowed, and what it changed, in a record the agent could not alter. Coding agents like Claude Code and Cursor are now production actors: they run shell commands, edit infrastructure code, open pull requests and call MCP tools that reach live systems.
Decide first which obligations the record has to satisfy, because they set retention and content. Confirm the specifics with your own legal and compliance team. The summary below is the common baseline, and what an auditor actually asks for covers each framework in more depth.
| Record field | What it proves | Framework that tends to ask |
|---|---|---|
| Intent | The instruction or task the agent was acting on, and who gave it | SOC 2 change management, internal incident review |
| Context | The production state the agent read before acting | Incident review, EU AI Act traceability |
| Authorization | The policy verdict, the deciding policy, and any human approver | SOC 2 CC7, ISO/IEC 42001 operating evidence |
| Effect | What the action touched, including predicted and actual reach | Incident review, regulator inquiries |
| Identity | The specific agent instance, role and session | Every framework: unattributable actions fail all of them |
| Integrity | A signature and a chain to the previous record | SOC 2 Type II sampling, EU AI Act Article 12 logging |
Then locate where your agents run: developer laptops, CI runners, or production clusters. Each location has a different place a trustworthy record can be written from.
The steps
Define audit requirements for AI agents
An AI agent audit requirement specifies what must be recorded for each action so the record proves the action was governed, not merely that it happened. The working model has four parts: intent, context, authorization and effect. A time-versioned record of production state serves as the context half, because it shows what the agent saw at the moment it acted.
1. Write the four-part schema down. For every action: intent (task and requester), context (entities and their state at decision time), authorization (policy, verdict, approver) and effect (what changed, and predicted blast radius). Keep the schema identical across agents so queries work across all of them.
2. Record refusals as first-class entries. A trail of permitted actions alone cannot distinguish a well-governed system from one where policy never fired. Refusals are the evidence the control was live.
3. Separate the decision record from the payload. Keep verdicts, identities, timestamps and signatures for the full retention period, and minimise personal data inside tool arguments. That satisfies audit retention without holding data GDPR says you should not keep.
Implement governance for AI agent workflows
Governing Claude Code, Cursor or any agent workflow means every action passes through a point that records it and can refuse it, and that point sits outside the agent. The agent's transcript still has value as the intent layer, but the authoritative record has to come from a vantage point the agent cannot write to.
4. Capture intent from the agent side. Claude Code and Cursor both expose hooks that run around tool calls. Use them to record the task, the prompt that led to each action, and the agent's own explanation. Treat these as intent records, useful and untrusted.
5. Log mode transitions. The moment an agent moves from answering questions (Cursor's Ask mode, Claude Code's plan mode) to editing files and running commands is the moment its risk changes. Record every switch with the identity that made it.
6. Write the authoritative record outside the agent. Observe the session from a boundary the agent cannot reach: the host side of a microVM, a network proxy, or the enforcement gate in front of production tools. Who audits the AI agent sets out why the hardware boundary is the most trustworthy of these vantage points. NOFire AI records every command, file and call an agent makes from outside the agent, signs each line independently, and exports it to your SIEM.
Enforce runtime policies for incident remediation
For incident remediation, the audit trail is most defensible when it is produced by the same control that allowed or refused each action. Enforced policy decisions become the evidence, so a missing record and a missing enforcement are the same event rather than two things that can drift apart.
7. Route remediation actions through a policy gate. Rollbacks, restarts, scaling and config changes proposed by an agent pass through enforcement before they run. Reads go through. Writes wait for a verdict or a person.
8. Sign the verdict with the predicted impact. Attach the blast radius computed before execution, so the record shows what was known at decision time. How blast radius is calculated covers why this comes from the dependency graph.
9. Make the common queries cheap. Every action in a time range, every action by one identity, every refusal, and every action touching one service. Evidence assembled by hand from three systems will not arrive inside an audit window.
Verify it worked
Pick a random two-hour window from at least a month ago and produce the complete, signed set of agent actions for it, including refusals, without touching the agents themselves.
Compare one Claude Code or Cursor session's transcript with the external record. They should agree. Where they diverge, the external record is the one to trust, and the divergence itself is worth investigating.
Attempt to edit a past record. The signature chain should make the edit detectable.
Where it breaks
Shared credentials. An agent running under a developer's personal cloud token produces actions attributed to the developer. Attribution fails at design time, and retention cannot fix it.
Channels outside the gate. An out-of-band record covers actions that cross the boundary it observes. An agent with a second path to production is unrecorded on that path.
Retention set to the minimum. Six months is a floor in one framework. SOC 2 observation periods and sector rules in financial services and gambling regulation often require longer.
Transcripts treated as evidence. The most common failure, because transcripts are detailed and easy to export. Detail is not integrity.
Frequently asked questions
- What do I need to log to prove an AI agent's actions for the EU AI Act or SOC 2?
- Per action: the policy verdict and the policy that decided, the tool call and arguments, the predicted impact, the bound agent identity, any human approval, a timestamp, and a signature chaining it to the previous record. The EU AI Act asks deployers of high-risk systems to keep such logs for at least six months.
- Is a Claude Code or Cursor transcript enough for an audit?
- No. The transcript is written by the agent, in the same context a prompt injection can reach. It is a good debugging aid and a weak witness. Corroborate it with a record written from outside the agent's process.
- What software keeps an audit trail of automated incident remediation?
- Look for a record written at the enforcement point rather than by the remediation agent: each action, the verdict that allowed or refused it, the approver, and the predicted blast radius. NOFire AI produces that record as a byproduct of enforcing policy on each action.
- Which incident tools have audit trails suitable for fintech or iGaming?
- Regulated operators need records that are complete, tamper-evident, attributable to a named identity, and retrievable for a window the examiner picks. Ask each vendor to produce every agent action for a random two-hour window from months ago, signed, during the evaluation.