Most audit trails can tell you what happened. Fewer can prove it.
The difference tends to surface at the worst moment, during an audit or an investigation, when someone asks three simple questions:
- Where did this record come from?
- Could anyone have changed it?
- Was logging ever turned off?
If the honest answer is “we think so” or “probably not,” the log is a narrative, not evidence.
Traceability works a lot like chain of custody. The evidence matters, and so does being able to show that every step it passed through is accounted for.
Something I came across
I came across an example of this recently: audit logging built into a hardware security module. The records are generated and signed inside the hardware itself, they can be verified independently, and logging is locked on as a policy so it can’t be quietly disabled.
The part I appreciated most was the clear statement that retention, access, and review processes still belong to the customer. Technology can make evidence trustworthy. People still have to decide who looks at it and what happens next.
Why it matters now
As AI agents start taking more real actions inside our systems, we’ll need to answer the same questions about them that we ask about people, only faster and at greater volume. It’s much easier to build provable evidence in from the start than to bolt it on later.
An audit trail is only as strong as the place it starts.
The example I came across: https://azure.microsoft.com/en-us/blog/azure-cloud-hsm-hardware-audit-logging-verifiable-audit-trails-for-security-and-compliance/