# AI agent audit trail, every attempt kept, every action signed.

> Hawcx records every AI agent attempt, allowed or denied, tied to the agent and the employee it answers to. Each permitted action carries a signed receipt.

Markdown version of <https://www.hawcx.com/ai-agents/audit>. Last updated 2026-10-07.

Hawcx records what every agent tried, including stopped calls, and who it acted for.

## Which agent, for whom, and why. Kept for every attempt.

The Hawcx AI agent audit trail records every tool call an agent attempts, allowed or denied, with the agent, the employee it answers to and the reason. Calls by agents with no identity are kept too.

[AI agent authorization on every tool call](https://www.hawcx.com/ai-agents/authorization)

## Every permitted action is signed. Every stopped attempt is still kept.

Each action Hawcx permits gets a signed receipt. Stopped attempts get no receipt, because nothing ran, but they stay in the audit trail. When a person approves an action, the approval appears on its receipt.

[Security and trust](https://www.hawcx.com/security)

## Audit trail questions, answered.

Before this: [Human approval for sensitive agent actions](https://www.hawcx.com/ai-agents/approvals)

After this: [AI agent governance](https://www.hawcx.com/ai-agents#govern)

### What should an AI agent audit trail include?

An AI agent audit trail should include which agent acted, the employee it answers to, the tool it called, the decision and its reason, and the time. Hawcx keeps the attempts it stopped as well as the actions that ran, so the trail shows what an agent tried, not only what it did. Each permitted action also carries a signed receipt.

### What is a signed receipt?

A signed receipt is the record Hawcx signs and attaches to each action it permits. Attempts that Hawcx stopped get no receipt, because no action ran. Each receipt names the agent, the person it acts for, the tool call and the time. Its signature can be exported and checked offline.

### Are denied attempts recorded?

Yes. Hawcx records every attempt, including rejected calls that exceed an agent's ceiling and denied calls with no identity behind them. Hawcx can check only the traffic that passes a point you control: this gateway, your network egress or a managed device. Anything without a valid identity is denied there.

### Can AI agent audit logs go to our SIEM?

Every Hawcx audit record, allowed or denied, uses the same fields: the agent, the person it acts for, the tool it called, the decision and its reason, and the time. Hawcx can send those records to your SIEM and dashboards.

### Who does each audit record name?

Each audit record names the agent that made the call and the employee it answers to. When an agent has no identity, its record reads “no human root” and the attempt is still kept. The employee can sign in with Hawcx passwordless or your identity provider, such as Okta or Microsoft Entra ID, and is named the same way.

## Show what every agent did. And the person it acted for.

- [AI agent authentication platform](https://www.hawcx.com/ai-agents)
- [Hawcx for Enterprise](https://www.hawcx.com/enterprise)