Audit Logs

When legal asks 'who accessed customer X's data?' or security investigates a bad output, you need tamper-evident logs — not scattered application debug prints.

Security camera footage with timestamps and badge IDs — not a colleague's memory of what happened last Tuesday.

Scenario

After a customer complains about an incorrect account closure, compliance searches audit logs by customer_id and finds the agent trace: user_id, retrieved policy version, tool `close_account` invocation, and missing human approval — root cause identified in minutes.

Solution

In Enterprise AI, apply Audit Logs to this scenario: After a customer complains about an incorrect account closure, compliance searches audit logs by customer_id and finds the agent trace: user_id, retrieved policy version, tool `close_account` invocation, and missing human approval — root cause identified in minutes. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.

Do this before moving to the next module — reading alone is not enough.

Open the Code Walkthrough below and run it locally. Change one parameter related to Audit Logs (e.g. model, temperature, top_k, or tool name), observe the difference in output, and write 2–3 sentences explaining what changed.

Highlighted lines show where Audit Logs happens in the code.

1function audit(event) {  # key line for Audit Logs2  const entry = {3    ts: new Date().toISOString(),4    trace_id: event.traceId,5    actor_id: event.actorId,6    action: event.action,7    resource: event.resource,8    outcome: event.outcome,9    metadata: redactPII(event.metadata),10  };11  auditSink.append(entry); // append-only stream → SIEM  # key line for Audit Logs12}

• Treating Audit Logs as a black box without evaluation
• Ignoring cost and latency in production
• Skipping error handling for audit logs

Quick recap — the most important points from this module.