If your agent did something wrong last Tuesday, could you prove what?
Reconstruction-grade logging for agentic systems — the evidence standard to set before go-live. Every agentic-AI conversation eventually reaches the same question, usually from the least technical person in the room, and it is the best question asked all day: if the agent does something wrong, will we know what happened?
For most deployments we look at, the honest answer is no. There is a model-provider dashboard, some application logs written for debugging, and a vendor’s assurance that everything is tracked. Then an incident arrives, and the organization discovers the difference between having logs and being able to reconstruct.
Reconstruction, stated as one sentence.
Reconstruction is the standard that matters, because it is the standard the aftermath demands: the incident responder needs it to bound the damage, counsel needs it to establish what did and did not happen, and increasingly a regulator will ask for it in exactly those terms. NIST’s AI Risk Management Framework and its Generative AI Profile make traceability and documented accountability core Govern and Measure functions — not operational niceties.
So here is the test we apply: thirty days after the fact, a reviewer with no prior knowledge of the incident, given only the log, can determine what the agent read, what it did, what it was refused, who approved what, and under what configuration — and can demonstrate the record wasn’t altered. Everything below just unpacks that sentence.
What the record must hold.
Six elements. An incident is reconstructable only when all six are present for every run.
01Who the agent was
The agent’s own identity — not a shared service account, not a human’s borrowed credentials — and the credential scope it held at that moment. Without this, you cannot distinguish “the agent did it” from “something with the agent’s password did it,” and that distinction is the whole investigation. (Unique non-person identity: NIST SP 800-53, IA family.)
02What it read
The inputs and retrieved content, by source and identifier. Indirect prompt injection — the top risk on OWASP’s LLM Top 10, 2026 edition as before — arrives through content. If you cannot see what the agent read, you cannot find the document that turned it, and you will keep processing the poisoned source tomorrow. MITRE ATLAS’s retrieval-poisoning techniques are found in the read-trail or not at all.
03What it did
Every tool invocation with its full arguments — not “the agent called the email tool” but recipient, subject, and content actually sent. Summaries are for dashboards; reconstruction needs the arguments, because the arguments are where the harm lives.
04What it was refused
Every policy denial: the tool call outside the allow-list, the query outside the retrieval boundary, the egress attempt that hit the default-deny wall. Denials are the most valuable lines in the entire record — they are the attack becoming visible while it is still failing — and they are the lines most logging setups throw away because nothing “happened.” Log the attempts; alert on their rate.
05Who approved
For every gated action: which human, when, and — the detail that decides whether the gate was real — what they were shown at the moment of approval. “Approved” next to a rendered diff is accountability. “Approved” next to a request ID is a formality that will not survive its first deposition.
06Under what configuration
Model identity and version, prompt and policy versions, tool registry state. Agentic behavior changes when any of these change; an incident cannot be replayed, or attributed to a change, without knowing which stack produced it. This is ordinary configuration-management discipline (the CM family) extended to the parts of the stack that didn’t exist five years ago.
The properties that make it evidence.
Capture is half the standard. The other half is what makes the record trustworthy, and it is where NIST SP 800-53’s audit family (AU) has been giving the correct answers since before language models existed:
- The agent cannot write to its own log. Append-only, held outside the agent’s privilege boundary (AU-9). An actor with edit access to its own audit trail does not have an audit trail — and an injected agent is an insider whose instructions now come from outside.
- Selected, not hoarded. AU-2’s discipline is choosing which events matter and capturing those completely, rather than capturing everything at debug verbosity and finding the signal drowned. The six elements above are the selection.
- Retention is a decision with a date on it. Long enough to serve investigation and any regulatory horizon — and deliberate about the tension the Generative AI Profile flags: the read-trail can itself contain sensitive content, so the log inherits the data-protection obligations of the most sensitive thing the agent reads. A transcript store is not exempt from privacy law because it is called telemetry.
- Reviewed while boring. A log first opened during an incident will be missing something; that is close to a law of nature. Periodic review and correlation (AU-6) — even lightweight — is what finds the gap while it is still cheap.
Two answers to refuse.
“The vendor logs everything.” The provider’s logs serve the provider’s purposes, sit in the provider’s trust domain, follow the provider’s retention schedule, and are complete on the provider’s say-so. Identity scope, your policy denials, your approval content, your configuration state — these largely live on your side of the boundary, and no one else can capture them for you. Vendor telemetry can supplement a reconstruction record. It cannot be one.
“We’ll add logging once it’s in production.” Reconstruction capability is an acceptance criterion, not an enhancement. The test writes itself: run the workflow, wait, hand a reviewer the log cold, and grade the reconstruction. If a workflow cannot pass that test, it is not ready to hold credentials — and a team that resists the test is telling you something about what the log would show.
The layer that disciplines all the others.
Logging looks like the dullest layer of the containment stack, and it is quietly the one that disciplines all the others. You cannot demonstrate that tool policy is enforced outside the model, that retrieval fails closed, or that approval gates show real content except through the records those controls emit — the log is where every other control either leaves evidence or is revealed to be a diagram. That is why, when we review an agentic system, the audit trail is often where we start: it is the cheapest place to catch an architecture that is confident on the whiteboard and vague in the runtime.
Apogee reviews and constrains these systems; we do not build them, and we sell no logging product — the standards cited below are public, and the test in this note can be run against any stack, including without us. That is rather the point.
Standards referenced (all verified current, August 2026): NIST SP 800-53 Rev. 5, Release 5.2.0 — AU family (esp. AU-2, AU-3, AU-6, AU-9), IA and CM families; NIST AI RMF 1.0 (AI 100-1) and Generative AI Profile (AI 600-1); OWASP Top 10 for LLM Applications, 2026 edition; OWASP Agentic Security Initiative guidance; MITRE ATLAS.
Set the evidence standard before go-live.
The reconstruction test above is part of the review standard behind our AI implementation advisory — alongside the six-layer containment stack it makes testable.