AI agents need an audit trail before they scale, PAI researchers warn

An agent log that records tool calls can still leave a basic question unanswered: who authorized the work? In an October 29 opinion in MIT Technology Review, Partnership on AI researchers Madhulika Srikumar and Claire Leibowicz argue that deploying agents safely requires better records of their identity, human oversight and changing permissions.

Their intervention builds on PAI’s The Observability Gap in AI Agents, whose original overview is dated October 7. That assessment examined four widely used agent frameworks against six monitoring goals. The new article is a call to address the gaps before agents scale further, rather than an announcement of a new benchmark or an enacted monitoring requirement.

The missing records are about authority

PAI’s report overview identifies six categories of telemetry that the assessed frameworks emit inconsistently or not at all: persistent agent identity, permission-mode changes, memory changes, human intervention, chain-of-thought reasoning and token-level log probabilities.

The practical problem is larger than tracing a single request. An identity scoped only to one run makes it harder to connect an agent’s later actions to the permissions it was granted. Missing human-intervention records make it difficult to reconstruct who approved an action, what authority they had and what they decided. Changes to memory or permission modes can alter subsequent behavior without leaving a suitable trace.

The report describes differences between frameworks, rather than claiming every framework has exactly the same limitations. Its overview says only Claude Agent SDK recorded mid-session permission-mode changes in the assessment. These are the researchers’ findings about the systems assessed, not an AITrending audit of every current release.

Recording actions is easier than explaining decisions

Srikumar and Leibowicz distinguish records of what happened from records intended to explain how an agent decided. They argue that persistent IDs, human interventions and permission or memory changes are largely an instrumentation problem that framework developers and shared standards can address.

The authors point to OpenTelemetry’s work on common agent-tracing formats and call for these signals to be incorporated while the formats are still being developed. They also stress the privacy implications of an agent identity that can be linked to a person.

Decision records are less settled. A displayed chain of thought is not necessarily a faithful account of how a model reached an answer. Confidence signals are also an imperfect guide to whether a decision was sound. The opinion presents these as open research questions, not a claim that collecting more reasoning text solves oversight.

Enterprises still have to define the rules

The authors ask framework developers to produce the missing records, enterprises to demand them and regulators to specify what evidence high-stakes deployments should retain. Their argument also has a concrete limit: telemetry cannot decide whether an action broke a rule unless the deploying organization has defined its policies, permissions and roles.

For teams moving agents into consequential workflows, the proposed shift is from merely seeing activity to being able to reconstruct authority and intervention. The October 29 article advances that case; it does not establish that any particular logging product now provides complete monitoring or that new standards have already been adopted.