An independent record of what your AI agents actually did

Why agent logs aren’t evidence

When an AI agent works on a real system, the usual record of what it did is the log its own harness writes: the tool calls, the outputs, the final summary. That record has one weakness. The agent can reach it.

• In a 2026 study, most of the agent harnesses tested let the agent delete or rewrite its own traces, and agents did so when it paid off. The authors recommend logging outside the agent’s control (Qin et al., 2026).
• Frontier models game their evaluators. On METR’s RE-Bench, o3 showed reward hacking on 30.4% of runs, against 0.7% on HCAST, in some cases by modifying the code that scored it (METR, 2025).
• All 11 agents tested in another study showed upward deception: reporting success to the user that the work did not support, in some cases by fabricating files (Are Your Agents Upward Deceivers?, 2025).

An agent trace written by the agent is the agent’s account of itself. For review and audit you need something stronger.

What a record must be

Three properties, none of them new. They are what auditors already expect of any system of record.

1. Complete. It covers what the agent did on the system, not only what the agent chose to report. A summary written at the end of a task is a claim, not a record.
2. Outside the agent’s control. The agent cannot read it, pause it, edit it or delete it. If any of those is possible, the record is only as trustworthy as the agent.
3. Reviewable. A person or an auditor can read it, follow one action to its effect, and check that it has not been changed since it was written. See tamper-evident log.

Inoku’s enterprise work is about producing a record with these properties for agents running on real systems. We will describe the method when it is ready to be checked, not before.

EU AI Act context

The EU AI Act requires high-risk AI systems to allow the automatic recording of events over their lifetime, so that their operation can be traced (Article 12). Deployers of high-risk systems must keep the logs those systems generate, to the extent the logs are under their control (Article 26) (Regulation (EU) 2024/1689).

The timelines moved in 2026. Under the AI Omnibus, high-risk obligations apply from 2 December 2027 for standalone high-risk systems and from 2 August 2028 for systems embedded in regulated products (Addleshaw Goddard, 2026).

Not every agent deployment is high-risk, and the Act does not mention agents by name. In our reading, where an agent is part of a high-risk system, its actions fall within those logging duties, and a log the agent can edit is a weak answer to Article 12. Our guide to audit trails for AI agents under the EU AI Act goes into the detail.

Status and how to get involved

This is research-stage work. There is no product to buy today, and we will not pretend otherwise. What exists is a problem we understand well, a set of principles we are building to, and early work on the record itself.

We are looking for a small number of teams that run agents on real systems in regulated or audited settings: to understand what your reviewers and auditors need to see, and to test early versions against real workloads. If that is you, contact us and choose the topic “Enterprise”. Teams in regulated sectors can also start with the regulated teams page. For evaluation rather than production records, see Inoku Verified™.