The audit trail: why every agent action is logged (and how to read yours)

When an AI agent moves money, sends an email on your behalf, or books an appointment for a customer, the question that should be on your mind is not "is this AI smart enough" but "can I prove what it did and why." Trust in agents is a function of two things: the agent's track record, and the audit trail. Track record is earned over time. The audit trail is engineered up front, or it never happens at all.

This post is what the agent's audit trail actually contains, how to read yours, where the logs live, and what they protect against. It is the documentation an auditor would ask for; it is also the explanation a reasonable user wants when they ask "wait, what did the agent do last Tuesday?"

What gets logged

Every agent action against an external tool generates a structured log entry. The schema is consistent across actions:

The "citation" field is the under-discussed one. When the agent decides to do X, it can usually point at a memory or a context that justifies the decision. ("Booking with Felipe's because the user has booked there 3 times before.") The citation is not always perfect, sometimes the agent's reasoning is implicit and reconstructed, but the discipline of writing one has been one of the highest-leverage decisions we made early.

Where the logs live

A few honest specifics.

On-database, per-user. Your action logs are written to your own per-user database partition. Cross-user log access is impossible by construction (per-user isolation at the database layer). The only people who can read your logs are you, and the small set of internal staff with explicit support access (logged in turn, on a separate audit surface).

Retention. Logs are kept indefinitely by default. You can export them as JSON or CSV at any time. You can also request deletion of logs older than a certain date, with the caveat that some categories (financial transactions, tax-relevant invoices) have legal retention requirements we honour.

Encryption at rest. Standard.

How to read yours

Three ways.

Ask in plain English. "Show me everything you did yesterday." The agent returns a chronological list with the high-level actions. Drill in by asking for specifics ("show me the email sends," "show me the Stripe transactions").

The manage page. Every Ajeris user has a per-user manage page with a logs tab. Filterable by tool, date, action type. Clean enough for an accountant to use.

Export. "Export my logs from January 1st through today as CSV to my email." The agent runs the export and emails you the file.

For most users, the in-conversation surface is enough. For users with formal compliance needs (small business owners, regulated industries), the export is the path.

What this protects against

Three real failure modes.

Mistaken actions. The agent acts on a misunderstood request. The log shows the trigger (your message), the tool called (the action it took), and the citation (why it thought this was right). You can see the chain of decisions and correct the misunderstanding. The reversal is one sentence ("undo the email I sent to Sara at 3:14pm") and the agent reverses it.

Unauthorized actions. Someone got access to your account and asked the agent to do things. The log shows what was done, when, and from which channel. You can see the unfamiliar actions and revoke the channel that originated them. (We also have rate-limiting and anomaly detection that flags suspicious volumes; the audit trail is the after-the-fact reconstruction.)

Accountability with a third party. A customer claims you sent them something you did not. The log shows whether the agent sent it, when, and the exact content. You can produce evidence in a dispute.

The third one is the use case most small-business operators do not anticipate but most appreciate when it shows up. A customer disputes an invoice; you show them the agent's record of every text message exchanged about the work, in chronological order, with timestamps. The dispute resolves in your favour because the record is precise.

What the agent cannot do without leaving a trace

Three categories of action that always have visible logs:

• Send anything. Emails, SMS, WhatsApp, Telegram messages. Logged with the recipient, the body, the channel, and the trigger.
• Move money. Stripe payments, refunds, payment links. Logged with amount, recipient, and the source authorization.
• Modify external state. Calendar entries, CRM records, file edits, deployments. Logged with before/after where applicable.

Three categories that are NOT in the public log (because they are read-only or internal):

• Reading your data. When the agent looks at your inbox to summarize, it does not write a per-read log. (Read access is OAuth-scoped, so the data was authorized to be read; the agent does not need to log every read.)
• Internal reasoning. The agent's chain-of-thought is not exposed in the log. The decision is, but the deliberation is not.
• Memory writes. Internal memory updates do not surface as user-facing log lines. They are visible via "what do you remember about me," but they are not in the action log.

The line is "external action" vs "internal state." External actions log; internal state evolves.

What we do not yet have

Honest disclosures.

Partial citations. For complex multi-tool actions, the citation field is sometimes "based on the conversation context" rather than a specific memory ID. We are tightening this; the work is ongoing.

Cross-user log access for shared workspaces. Today, business workspaces share customer-record visibility but agent action logs are per-user. We are adding shared visibility for actions taken on behalf of the workspace.

External integration with SIEM tools. For users on enterprise plans who want logs flowing into Splunk, Datadog, or similar, we have a webhook surface but not turnkey connectors. The webhook works; the polish does not yet.

Try it

Ask the agent: "What did you do yesterday?" The list it returns is your audit trail in human-readable form.