What an auditable agent trajectory actually contains
Logging the prompt and the answer is not an audit trail. Here is the record a regulated firm needs to reconstruct any AI-assisted decision.
When examiners, internal audit, or an LP asks what happened on a specific run, the answer cannot be "the model decided." It has to be a record: what came in, what the system did, what it consulted, what it produced, and who approved it.
Most teams log the prompt and the completion. That is enough to debug a demo and nowhere near enough to defend a decision six months later, after the model version has changed twice and the retrieval corpus has been re-indexed.
The minimum viable trajectory record
A trajectory is the full ordered record of a single run. At minimum it should capture:
- Run identifier, timestamp, triggering event, and the initiating user or service account
- Exact input payload, including document hashes rather than just filenames
- Prompt template version and the resolved prompt after variable substitution
- Model identifier, provider, and pinned version, plus sampling parameters
- Every tool call with its arguments, response, latency, and retry count
- Every retrieved chunk with its source document, page or offset, and index version
- Intermediate model outputs, not only the final one
- Validation results: schema checks, business-rule checks, confidence thresholds
- Routing decisions and why an item escalated or auto-cleared
- Human review events: reviewer identity, edits made, approval or rejection, timestamp
Replay is the test
The practical test of a trajectory record is replay. Can you take a run from three months ago and re-execute it against the pinned model and the archived index, and get the same result? If you can, your record is complete. If you cannot, something material was never captured.
Replay also gives you a cheap regression signal. When a model version changes, replaying a sample of historical runs shows exactly which outputs move and by how much, before the change reaches production.
Retention and access
Trajectories contain source content, so they inherit the sensitivity of the underlying documents. Store them under the same classification, apply the same retention schedule as the decision they support, and restrict access to the same population that could read the inputs.
One practical detail that saves considerable pain: store the trajectory alongside the artifact it produced. A credit memo whose supporting trajectory lives in a separate observability tool with a 30-day retention window is not auditable.