By KYN AI Advisory Team — AI implementation specialists, Singapore
An AI agent log must answer six questions for every action: who acted, what was done, on which record, when, why, and who approved. If a log line cannot answer all six, it is a debug message, not an audit record. Write the log to storage the agent cannot edit, keep it for a period you have chosen on purpose, and review it on a schedule. Without that, you cannot investigate a mistake or show a client what happened.
Why do agents need stricter logs than software?
Ordinary software does what its code says. An agent chooses among actions based on text it reads, and the same input can produce different output on different days. When something goes wrong, the code alone does not explain it. You need the record of what the agent saw and did.
Three needs drive the standard.
- Investigation. A customer says they never agreed to a message. You need to show who or what sent it, from which draft, approved by whom.
- Accountability. If an agent runs under a shared login, nobody can say who is responsible. Named accounts make responsibility traceable.
- Detection. Unusual behaviour, such as an agent calling a tool it never used before, only shows up against a record of normal behaviour.
What are the six fields every record needs?
| Field | Content | Example | |---|---|---| | Actor | The account that acted: person or agent, by name | reply-sorter-prod or a staff account | | Action | The verb, from a fixed list | label_reply, draft_email, post_journal | | Target | The record affected, by identifier | Contact 4821, invoice INV-2207 | | Time | Timestamp with timezone, set by the server | 2026-10-30T08:14:05+08:00 | | Reason | Rule or input that triggered it | Reply received; rule unsubscribe_stop | | Approver | The person who approved, if the action was gated | A named staff member, or none: not gated |
Add two more in practice: the before and after values for any change, and a run identifier that ties together every step of one agent run. With a run identifier you can replay what the agent saw, what it called and what it produced.
The actor field is the one most often wrong. Shared logins and service keys used by several agents write "admin" or "system" on every line. Use a separate account for each agent and each person, issued through the cloud provider's identity service.
What should be logged beyond actions?
Actions are the minimum. Four other event classes protect you.
- Reads of sensitive data. Who or what opened a payroll table or a client's file. Read logs are large, so log reads of sensitive tables, not every row.
- Tool calls. Each call an agent makes to another system, with the parameters and the response status.
- Model calls. The model used, the size of the input and output, the cost and a reference to the stored prompt. Whether to store the full text is a decision, covered below.
- Authentication and permission events. Logins, failed logins, role changes, key creation and rotation.
The agent's refusals matter too. When a gate blocks an action, log the block and the reviewer's decision. A pattern of rejections is a signal about the agent's quality.
Should you store the full prompt and response?
It is a trade-off between investigation and exposure.
- Store the full text and you can reconstruct any decision. The log now holds customer data, so it needs the same access controls as the source system, and a retention period.
- Store a reference (the record ID and the version of the prompt) and the log stays small and clean. You rebuild the context from the source when needed.
A workable pattern: log references by default; store the full input and output for gated actions and for failures, with restricted access and a short retention period. Decide once and write it down.
How long should you keep logs?
Pick a period tied to a reason, not a default.
- Legal and regulatory minimums. Accounting records in Singapore must be retained for a set period under the Companies Act; check ACRA for the current requirement for your records. Payroll, tax and CPF records have their own periods with IRAS and the CPF Board.
- Investigation need. How far back would you look to explain a dispute? Contracts with a long tail justify longer retention.
- Data protection. Personal data in logs must not be kept longer than needed. Singapore's PDPA has a retention limitation obligation; see PDPA and AI agents in Singapore.
Split by class. Keep the audit record (actor, action, target, time, approver) longer, because it is small and holds little personal data. Keep full prompt text shorter.
Where should logs be stored?
Four rules.
- Append only. The agent's own account can write new lines and cannot edit or delete old ones.
- Separate from the system it watches. A log in the same database the agent can write to is a log the agent can alter if fooled. Use a separate store or a separate account with write-once permissions.
- Time from the server. Never accept a timestamp from the agent.
- Backed up and recoverable. Test a restore.
Cloud providers offer this directly. AWS CloudTrail, for example, records account activity and API calls, and Google Cloud has Cloud Audit Logs. Use them for infrastructure events, and add application-level logs for what the agent did with business records.
Who reviews the logs, and how often?
Logs nobody reads protect nobody. Set a rhythm.
- Daily, automated. Alerts on rules: a read-only agent attempting a write, a new outbound domain, a failed login spike, an action volume far above the norm.
- Weekly, a person. Ten minutes on the gated queue: approvals, edits, rejections. Look for patterns.
- Quarterly, a person. Access review. List every account with access, remove the ones no longer needed, and check that each agent still holds only the permissions of its task.
Keep the review itself on record. A line saying who reviewed what, when, is evidence for a client questionnaire or an auditor.
What are the common failures?
- Shared logins. The actor field is useless.
- Logs in the same database as the data. One breach or one bug covers its tracks.
- No retention rule. Logs grow until someone deletes them in a panic.
- Full prompts everywhere. The log becomes the biggest copy of customer data.
- No alert. The first person to read the log is the investigator, after the damage.
- Clock drift. Timestamps from different systems disagree, and the sequence of events is unclear.
Where KYN fits
KYN builds logging in from the first sprint. Named accounts through the cloud provider's identity service mean no shared logins, and every action is logged with the actor. Agents have their own restricted accounts, so the log tells an agent from a person. Outbound messages, money, filings and deletions wait for a named person, and the approver is on the record. The logs sit in the client's own cloud account.
KYN's own books follow the same pattern: bills from Gmail, receivables chased at 3, 14 and 30 days, and payroll on 2026 CPF rules, each step logged with the actor. The first 14 days are a review of your stack and interviews with your team. A full build ships in under 90 days. See security and finance.
Frequently asked questions
How much does agent logging cost?
Storage for structured audit lines is small, because each line is a few hundred bytes. The larger costs are full prompt text and read logs on busy tables, so decide what to keep. Ask your cloud provider's pricing page for the storage rate in your region.
Can the agent write its own explanation of why it acted?
It can, and the explanation is useful to a reviewer. Treat it as a note, not as evidence. The record of the rule or input that triggered the action, written by the system and not by the model, is the evidence.
Do I need logs if a person approves every action?
Yes. Approval records who decided. The log records what was proposed, what changed and what the agent saw. You need both to explain an outcome.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
