Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Proactive Security Behavior Monitoring
Audit-log autonomous actions
Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.
OWASP AISVS v1.01, requirement 12.4.2
In plain English
Keep an audit log of the security-relevant actions agents take on their own initiative. Each record needs who approved the action, when, the exact parameters and what happened. Afterwards you should be able to say what the agent did and on whose authority.
What good looks like
- Each record has the approver's identity (or the policy that auto-approved), a timestamp, the full action parameters and the outcome.
- Records are tamper-evident and stored where the agent cannot change them.
- Records can be searched during an investigation.
- Denied and failed actions are recorded too.
How teams usually do it
- Structured audit logging from the tool gateway to append-only storage.
- Recording the agent identity, the user it acted for and the run ID with every entry.
Suggested evidence
- Sample audit records.
- Storage settings showing immutability.
- A search that reconstructs one agent run.
Common mistakes
- Logging the action and leaving out the approver.
- Logging a summary in place of the real parameters.
- Relying on the agent's own transcript as the audit trail.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.