AI agent audit trail, every attempt kept, every action signed.
Hawcx records what every agent tried, including stopped calls, and who it acted for.
AI agent activity log
Which agent, for whom, and why.
Kept for every attempt.
The Hawcx AI agent audit trail records every tool call an agent attempts, allowed or denied, with the agent, the employee it answers to and the reason. Calls by agents with no identity are kept too.
Each record shows:
ag_billing_001
on behalf of dana@acme.example
stripe:refund $180
allowed, within ceiling
27 Sep 2026, 14:11:36 UTC
Signed receipts for AI agents
Every permitted action is signed.
Every stopped attempt is still kept.
Each action Hawcx permits gets a signed receipt. Stopped attempts get no receipt, because nothing ran, but they stay in the audit trail. When a person approves an action, the approval appears on its receipt.
Security and trustAudit trail questions, answered.
Before thisHuman approval for sensitive agent actions
After thisAI agent governance
What should an AI agent audit trail include?
An AI agent audit trail should include which agent acted, the employee it answers to, the tool it called, the decision and its reason, and the time. Hawcx keeps the attempts it stopped as well as the actions that ran, so the trail shows what an agent tried, not only what it did. Each permitted action also carries a signed receipt.
What is a signed receipt?
A signed receipt is the record Hawcx signs and attaches to each action it permits. Attempts that Hawcx stopped get no receipt, because no action ran. Each receipt names the agent, the person it acts for, the tool call and the time. Its signature can be exported and checked offline.
Are denied attempts recorded?
Yes. Hawcx records every attempt, including rejected calls that exceed an agent's ceiling and denied calls with no identity behind them. Hawcx can check only the traffic that passes a point you control: this gateway, your network egress or a managed device. Anything without a valid identity is denied there.
Can AI agent audit logs go to our SIEM?
Every Hawcx audit record, allowed or denied, uses the same fields: the agent, the person it acts for, the tool it called, the decision and its reason, and the time. Hawcx can send those records to your SIEM and dashboards.
Who does each audit record name?
Each audit record names the agent that made the call and the employee it answers to. When an agent has no identity, its record reads “no human root” and the attempt is still kept. The employee can sign in with Hawcx passwordless or your identity provider, such as Okta or Microsoft Entra ID, and is named the same way.