C5 Audit Evidence for AI Agents: Logging, Monitoring, and Control Proof

C5 readiness depends on evidence. For AI agent platforms, evidence is harder than usual because important decisions happen across multiple layers: identity provider, application, model gateway, retriever, policy engine, tool router, and external API.

The audit question is not "do you have logs?" It is "can you reconstruct who did what, with which permission, against which data, through which system, and with what outcome?"

The Evidence Chain

1. Authentication event: user, tenant, login method, MFA status, session start
2. Agent task event: task ID, purpose, agent identity, allowed tools, approval tier
3. Authorization event: requested action, resource ID, policy decision, reason, scope
4. Retrieval event: query, candidate documents, allowed documents, denied documents, data classification
5. Model event: model provider, prompt template version, safety filters, response metadata
6. Tool event: target API, token scope, payload class, status, error handling
7. Operational event: alert, escalation, incident ticket, recovery action, post-incident review

What to Log and What Not to Log

Logging every raw prompt forever is not a control. It can become a data protection problem. The better pattern is classification-aware logging: enough metadata to prove control operation, with controlled retention for sensitive payloads.

• Always log: identity, resource IDs, authorization decisions, tool names, scopes, timestamps, outcomes
• Conditionally log: prompt text, retrieved snippets, API payloads, model responses
• Protect strongly: credentials, tokens, secrets, customer records, special category data, sensitive incident details

C5-Oriented Evidence Dashboard

Evidence Retention

Define retention by event class. Authentication and authorization metadata may have a different retention period than prompt payloads. Incident evidence may need a legal hold. Debug traces should usually have shorter retention than control evidence.

Bottom Line

C5-aligned AI agent evidence should be structured, queryable, and tied to control objectives. A pile of model traces is not audit readiness. A linked chain of identity, authorization, retrieval, model, tool, and incident events is.