{ "dataset": "Agent Audit Log Evidence Matrix", "description": "A version-stamped, quote-backed comparison of what six AI agent platforms document about tool-call and agent-action detail in their published audit and logging documentation, and which expose tool-level detail only as customer-instrumented telemetry rather than as a native audit log.", "publisher": "Stingrai Inc", "canonical_url": "https://www.stingrai.io/blog/ai-agent-audit-log-evidence-gap", "data_url": "https://www.stingrai.io/data/agent-audit-log-matrix/matrix.json", "csv_url": "https://www.stingrai.io/data/agent-audit-log-matrix/matrix.csv", "license": "CC BY 4.0", "license_url": "https://creativecommons.org/licenses/by/4.0/", "attribution": "Stingrai, Agent Audit Log Evidence Matrix, https://www.stingrai.io/blog/ai-agent-audit-log-evidence-gap", "accurate_as_of": "2026-07-28", "revalidation_cadence": "Quarterly. Next scheduled re-validation 2026-10-28.", "scope_rule": "Not documented is not the same as not present. A platform may log something it does not document. Every negative cell in this dataset reports the state of the published documentation on the retrieval date, not the behaviour of the running system. No platform was tested, probed, or accessed to verify behaviour.", "no_ranking_note": "This dataset does not rank, score, or grade platforms. There is no total column and no order of merit. Platforms are listed in the order they were reviewed. Capability per cell is reported so the reader can judge against their own evidence requirements.", "method_note": "Each platform was selected for market relevance and for having published audit or logging documentation that is publicly retrievable. Every yes or no cell is backed by a verbatim quoted sentence from that vendor's own documentation, stored in the quote field alongside the document URL and the retrieval date. Where the documentation is silent, the cell reads 'Not documented as of 2026-07-28'. Where a document could not be retrieved without authentication, that is recorded as a limitation rather than inferred.", "dimensions": [ { "id": "native_audit_log", "label": "Native audit log", "question": "Does the platform document a native, platform-provided audit log of activity that an administrator can retrieve?" }, { "id": "tool_calls_recorded", "label": "Individual tool calls recorded", "question": "Does the native audit log record individual tool calls, or only session, API, and administrative events?" }, { "id": "tool_arguments_captured", "label": "Tool arguments captured", "question": "Are the arguments passed to a tool captured, or only the tool name?" }, { "id": "human_principal_recorded", "label": "Human principal recorded", "question": "Is the human principal who initiated the agent action recorded in the audit record?" }, { "id": "retention_and_tamper_evidence", "label": "Retention and tamper evidence", "question": "Is a retention window documented, and is any tamper evidence mechanism documented for the log itself?" }, { "id": "customer_instrumented", "label": "Customer instrumented telemetry required", "question": "Is tool-level detail available only through telemetry the customer must wire up, rather than through the native audit log?" } ], "platforms": [ { "platform_id": "microsoft-foundry", "platform_name": "Microsoft Foundry (Azure AI Foundry) Agent Service", "vendor": "Microsoft", "audit_surfaces_reviewed": "Microsoft Purview Audit (Standard) records for Copilot and AI applications; Microsoft Foundry tracing (OpenTelemetry into Azure Monitor Application Insights).", "cells": { "native_audit_log": { "value": "Yes", "detail": "Microsoft Purview Audit (Standard) generates audit records for user interactions with AI applications, and the documentation names applications built using Microsoft Foundry as included in Audit Standard.", "quote": "The system automatically generates audit logs when a user interacts with Copilot, Cowork, or an AI application.", "supporting_quote": "All Microsoft applications, including Microsoft Copilots like Microsoft Security Copilot, Copilot in Microsoft Fabric, and custom applications built using Microsoft Copilot Studio and Microsoft Foundry are included in Audit Standard.", "source_title": "Audit logs for Copilot and AI applications", "source_url": "https://learn.microsoft.com/en-us/purview/audit-copilot", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Not documented as of 2026-07-28", "detail": "The documented audit record properties cover the agent identity, the plugins enabled for the interaction, and the resources the application accessed with the action performed on each. A per-tool-call audit record type is not documented. Tool calls and their results are documented in Foundry tracing, which is a separate, customer-enabled surface.", "quote": "Audit records also include references to files, sites, or other resources Copilot, Cowork, and AI applications accessed to generate responses to user prompts.", "supporting_quote": "Unique identifier for an agent.", "source_title": "Audit logs for Copilot and AI applications", "source_url": "https://learn.microsoft.com/en-us/purview/audit-copilot", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "Not documented in the native audit log as of 2026-07-28. Documented in customer-enabled tracing.", "detail": "Foundry tracing documents a tool.call.arguments attribute on the execute_tool span. Tracing is a separate surface from the Purview audit record and is off by default.", "quote": "Logs the arguments passed during tool invocation.", "supporting_quote": "Records the results returned by the tool.", "source_title": "Agent tracing in Microsoft Foundry (preview)", "source_url": "https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-agent-concept", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Yes", "detail": "Purview audit records for AI application interactions are documented as identifying the interacting user, the time, and the location of the interaction.", "quote": "These audit records contain details about which user interacted with Copilot, when the interaction took place, and where it occurred.", "source_title": "Audit logs for Copilot and AI applications", "source_url": "https://learn.microsoft.com/en-us/purview/audit-copilot", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Retention documented. Tamper evidence not documented as of 2026-07-28.", "detail": "A 180 day retention is documented for the pay-as-you-go user and admin interaction audit logs covering non-Microsoft AI applications. Trace retention is governed by the customer's Application Insights and Log Analytics configuration. No cryptographic integrity or tamper evidence mechanism for the audit records themselves is documented on these pages.", "quote": "This billing model provides user and admin interaction audit logs that the system retains for 180 days.", "supporting_quote": "Your Application Insights and Log Analytics configuration governs data retention and storage.", "source_title": "Audit logs for Copilot and AI applications; Microsoft Foundry Tracing and Data Handling", "source_url": "https://learn.microsoft.com/en-us/purview/audit-copilot", "secondary_source_url": "https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-data", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "Yes, for tool-level detail", "detail": "Tool call, argument, and result capture lives in Foundry tracing, which uses OpenTelemetry, is off by default, and begins only when an owner connects an Application Insights resource to the project.", "quote": "Tracing is off by default.", "supporting_quote": "No trace data is collected or stored unless explicitly enabled by Foundry Account Owner or Foundry Owner.", "source_title": "Microsoft Foundry Tracing and Data Handling", "source_url": "https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-data", "retrieved": "2026-07-28" } }, "incident_responder_note": "From the native audit record you can establish which user interacted with which agent, when, and which resources the agent read or modified in the course of the response. To recover which tool ran with which arguments, you need the tracing surface, which only holds data from the moment an owner enabled it." }, { "platform_id": "anthropic-claude", "platform_name": "Anthropic Claude Enterprise and Claude Code", "vendor": "Anthropic", "audit_surfaces_reviewed": "Compliance API Activity Feed (GET /v1/compliance/activities); Claude Code OpenTelemetry metrics, logs, and events.", "cells": { "native_audit_log": { "value": "Yes", "detail": "The Compliance API exposes an organization-wide Activity Feed covering authentication, chat, file, project, administrative, and platform actions.", "quote": "The Activity Feed records every authentication, chat, file, project, administrative, and platform action that occurs in your organization, in reverse chronological order.", "supporting_quote": "Programmatic access to your organization's Claude activity, chats, files, projects, and users for compliance, audit, and governance.", "source_title": "Query the Activity Feed; Compliance API overview", "source_url": "https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed", "secondary_source_url": "https://platform.claude.com/docs/en/manage-claude/compliance-api", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Not documented as of 2026-07-28", "detail": "The published activity type reference documents hundreds of activity types. The MCP and tool related types that are documented cover policy and configuration changes, for example mcp_tool_policy_updated, mcp_server_created, and mcp_tools_enabled. No activity type documented on that page represents an individual tool invocation.", "quote": "The permission restriction for an MCP tool was set or cleared.", "supporting_quote": "The Activity Feed produces hundreds of distinct activity types.", "source_title": "Activities (Compliance API reference); Query the Activity Feed", "source_url": "https://platform.claude.com/docs/en/api/compliance/activities", "secondary_source_url": "https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "Not documented in the native audit log as of 2026-07-28. Documented in customer-enabled telemetry, behind a second flag that is disabled by default.", "detail": "Claude Code emits tool_result and tool_decision events over OpenTelemetry. Tool parameters and input arguments are only included when OTEL_LOG_TOOL_DETAILS is set, which the documentation records as disabled by default.", "quote": "Enable logging of tool parameters and input arguments in tool events and trace span attributes: Bash commands, MCP server and tool names, skill names, user-authored workflow names, and tool input.", "supporting_quote": "Unique identifier for this tool invocation.", "source_title": "Monitoring usage (Claude Code)", "source_url": "https://code.claude.com/docs/en/monitoring-usage", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Yes", "detail": "Each Activity carries an actor object. The user actor shape documents email_address, ip_address, user_agent, and user_id, and the integration guidance names those fields as SIEM join keys.", "quote": "Calls to the Compliance API itself emit `compliance_api_accessed` activities.", "supporting_quote": "`actor.user_id` and `actor.email_address` are present when `actor.type` is `user_actor`; check the discriminator before reading them.", "source_title": "Design your compliance integration", "source_url": "https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Retention documented (6 years). Tamper evidence not documented as of 2026-07-28.", "detail": "The Activity Feed documents a 6 year retention and sub-minute availability. Reads of the Compliance API are themselves recorded as activities, which gives an access trail over the audit data. A cryptographic integrity mechanism for the feed is not documented.", "quote": "Activities are queryable within 1 minute of occurring and are retained for 6 years.", "source_title": "Query the Activity Feed", "source_url": "https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "Yes, for tool-level detail", "detail": "Tool level events come from Claude Code OpenTelemetry, which requires CLAUDE_CODE_ENABLE_TELEMETRY and an exporter. Tracing is documented as off by default, and argument capture requires the additional OTEL_LOG_TOOL_DETAILS flag.", "quote": "Tracing is off by default.", "source_title": "Monitoring usage (Claude Code)", "source_url": "https://code.claude.com/docs/en/monitoring-usage", "retrieved": "2026-07-28" } }, "incident_responder_note": "The Activity Feed gives a long-lived, identity-rich record of who did what at the chat, file, project, and administrative level, and it records reads of itself. Reconstructing which tool an agent called, with what input, and whether a human or a policy approved it depends on telemetry the customer turned on in advance." }, { "platform_id": "openai", "platform_name": "OpenAI API platform, ChatGPT and Codex enterprise surfaces", "vendor": "OpenAI", "audit_surfaces_reviewed": "Audit Logs API (GET /organization/audit_logs) as published in the OpenAI OpenAPI specification; Compliance API overview for ChatGPT and Codex; OpenAI Agents SDK tracing.", "cells": { "native_audit_log": { "value": "Yes", "detail": "Two native surfaces are documented. The Audit Logs API on the API platform lists user actions and configuration changes for an organization. A separate Compliance API covers the ChatGPT workspace and Codex.", "quote": "List user actions and configuration changes within this organization.", "supporting_quote": "A log of a user action or configuration change within this organization.", "source_title": "OpenAI OpenAPI specification, Audit Logs", "source_url": "https://github.com/openai/openai-openapi/blob/master/openapi.yaml", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Not documented as of 2026-07-28 in the publicly published event types. Compliance API event coverage is not publicly accessible.", "detail": "The published AuditLogEventType enumeration is administrative and configuration only: api_key.*, login.*, logout.*, project.*, rate_limit.*, role.*, scim.*, service_account.*, user.*, tunnel.*, workload_identity_provider.*, and tenant.*. No model invocation or tool invocation event type appears in it. For the ChatGPT and Codex Compliance API, the public page defers event coverage to an authenticated reference, which returned HTTP 403 to unauthenticated retrieval on the retrieval date.", "quote": "The authenticated Admin API reference is the source of truth for current access requirements, event coverage, routes, schemas, filters, retention, and request behavior.", "supporting_quote": "Use the Compliance API for security, legal, governance, and investigation workflows that require auditable records.", "source_title": "Compliance API and audit events", "source_url": "https://developers.openai.com/codex/enterprise/compliance-api", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "Not documented in the public audit log as of 2026-07-28. Documented in Agents SDK tracing.", "detail": "The Agents SDK wraps each function tool call in a function_span, and the span stores the inputs and outputs of the call. Traces are exported to the OpenAI backend and viewed in the Traces dashboard, which is a developer observability surface rather than an administrator audit log.", "quote": "Function tool calls are each wrapped in `function_span()`", "supporting_quote": "The Agents SDK includes built-in tracing, collecting a comprehensive record of events during an agent run: LLM generations, tool calls, handoffs, guardrails, and even custom events that occur.", "source_title": "Tracing (OpenAI Agents SDK)", "source_url": "https://openai.github.io/openai-agents-python/tracing/", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Yes", "detail": "Every audit log entry carries an actor. The actor is either a session or an API key, and both shapes resolve to a documented user object carrying id and email.", "quote": "The actor who performed the audit logged action.", "supporting_quote": "The user who performed the audit logged action.", "source_title": "OpenAI OpenAPI specification, AuditLogActor", "source_url": "https://github.com/openai/openai-openapi/blob/master/openapi.yaml", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Append-only stream documented. Retention window not publicly documented as of 2026-07-28.", "detail": "The Compliance API guidance describes an append-only compliance log stream for ongoing collection and advises customers not to rely on the source retention window. The specific retention figure is deferred to the authenticated reference.", "quote": "Use the append-only compliance log stream for ongoing collection.", "supporting_quote": "Don't assume the source retention window replaces your organization's retention policy.", "source_title": "Compliance API and audit events", "source_url": "https://developers.openai.com/codex/enterprise/compliance-api", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "Yes, for tool-level detail, and it is on by default in the Agents SDK", "detail": "This is the one reviewed platform where the tool-level trace is enabled by default rather than opt-in. It is still application-side SDK telemetry rather than an administrator-facing audit log, and it can be disabled globally or per run.", "quote": "Tracing is enabled by default.", "source_title": "Tracing (OpenAI Agents SDK)", "source_url": "https://openai.github.io/openai-agents-python/tracing/", "retrieved": "2026-07-28" } }, "incident_responder_note": "The public audit log answers administrative questions: who created a key, who signed in, who changed a project. Tool-level reconstruction depends on either SDK traces your application produced or on Compliance API event coverage you cannot evaluate from public documentation before you buy." }, { "platform_id": "google-agent-platform", "platform_name": "Google Cloud Gemini Enterprise Agent Platform (Vertex AI) and Agent Engine", "vendor": "Google", "audit_surfaces_reviewed": "Cloud Audit Logs for the Agent Platform (Admin Activity, Data Access, System Event); Agent Engine tracing into Cloud Trace.", "cells": { "native_audit_log": { "value": "Yes", "detail": "The platform writes Cloud Audit Logs. Admin Activity and System Event logs cannot be disabled. Data Access logs must be explicitly enabled by the customer.", "quote": "You can't disable Admin Activity audit logs.", "supporting_quote": "To receive Data Access audit logs, you must explicitly enable them.", "source_title": "Agent Platform audit logging information", "source_url": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/audit-logging", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Not documented as of 2026-07-28", "detail": "The audited operations table is expressed at API method level. The agent-relevant entries are session scoped: sessions.create, sessions.update, sessions.delete and sessionEvents.append under Data Access DATA_WRITE, and sessions.get, sessions.list and sessionEvents.list under DATA_READ. No per-tool-call operation appears in the table.", "quote": "The following table summarizes which API operations correspond to each audit log type in Agent Platform:", "supporting_quote": "sessions.create sessions.update sessions.delete sessionEvents.append", "source_title": "Agent Platform audit logging information", "source_url": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/audit-logging", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "Not documented in the audit log as of 2026-07-28. Documented in customer-enabled tracing, behind a second setting.", "detail": "Cloud Trace is documented as covering interactions with models and tools. The telemetry switch alone is documented as excluding prompt and response data. Capturing message content requires the additional OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT setting.", "quote": "GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY enables the agent traces and logs, but doesn't include prompts and response data.", "supporting_quote": "You can use traces to identify bottlenecks and understand interactions with large language models (LLMs) or tools.", "source_title": "Set up tracing (Agent Platform)", "source_url": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/tracing", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Yes", "detail": "Cloud Audit Logs record the calling identity in the AuthenticationInfo field of the AuditLog object.", "quote": "Audit logs record the identity that performed the logged operations on the Google Cloud resource.", "supporting_quote": "The caller's identity is held in the `AuthenticationInfo` field of `AuditLog` objects.", "source_title": "Cloud Audit Logs overview", "source_url": "https://docs.cloud.google.com/logging/docs/audit", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Retention governed by log buckets. Tamper evidence not documented as of 2026-07-28.", "detail": "The audit logging page defers retention to the Logging retention periods documentation, where retention is a property of the log bucket rather than of the audit log type. The undisableable status of Admin Activity and System Event logs is documented; a cryptographic integrity mechanism for the log files is not documented on these pages.", "quote": "You can't disable Admin Activity audit logs.", "supporting_quote": "For details on how long log entries are retained by Logging, see the retention information in Quotas and limits: Logs retention periods.", "source_title": "Agent Platform audit logging information; Cloud Audit Logs overview", "source_url": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/audit-logging", "secondary_source_url": "https://docs.cloud.google.com/logging/docs/audit", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "Yes, for tool-level detail", "detail": "Tool-level visibility comes from Cloud Trace, which the developer enables at deploy time through environment variables, or previously through an enable_tracing flag.", "quote": "Cloud Trace lets you analyze the performance of your agents by tracing the timeline of operations for each query.", "source_title": "Set up tracing (Agent Platform)", "source_url": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/tracing", "retrieved": "2026-07-28" } }, "incident_responder_note": "You can establish which principal created or read an agent session and when, provided Data Access logs were switched on before the incident. Tool arguments and model content live in Cloud Trace and only if two separate settings were both configured at deploy time." }, { "platform_id": "aws-bedrock", "platform_name": "AWS Amazon Bedrock and Amazon Bedrock AgentCore", "vendor": "AWS", "audit_surfaces_reviewed": "AWS CloudTrail management and data events for Amazon Bedrock and Bedrock AgentCore Gateway; Bedrock model invocation logging; AgentCore Observability.", "cells": { "native_audit_log": { "value": "Yes", "detail": "CloudTrail provides the audit record. Management events are on by default. Data events, which is the category that carries agent and gateway invocations, must be explicitly enabled.", "quote": "Amazon Bedrock is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Amazon Bedrock.", "supporting_quote": "You must explicitly enable data events as they are not captured by default.", "source_title": "Monitor Amazon Bedrock API calls using CloudTrail; Enable CloudTrail data event logging for AgentCore Gateway resources", "source_url": "https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html", "secondary_source_url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/enabling-cloudtrail-data-event-logging.html", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Yes, when data events are enabled", "detail": "This is the only reviewed platform whose native audit log documents the individual tool call. The published AgentCore Gateway data event example records the MCP method tools/call and the invoked tool name in requestParameters. Bedrock Agents runtime operations including InvokeAgent are also logged as data events.", "quote": "Amazon Bedrock logs all Agents for Amazon Bedrock Runtime API operations (such as InvokeAgent and InvokeInlineAgent) actions to CloudTrail as data events.", "supporting_quote": "\"method\": \"tools/call\"", "source_title": "Understanding Amazon Bedrock AgentCore Gateway CloudTrail events", "source_url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.html", "secondary_source_url": "https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "No, documented as redacted", "detail": "This is the only documented negative in the matrix. The AgentCore Gateway documentation states plainly that request and response contents in data events are redacted, and the published successful tools/call example shows arguments rendered as REDACTED. Full request and response bodies are available through Bedrock model invocation logging, which is a separate feature that is disabled by default and covers the bedrock-runtime endpoint.", "quote": "The contents of the requests and responses for data events are redacted, and the JSON Web Token (JWT) claims have HTML entities sanitized for security purposes.", "supporting_quote": "\"arguments\": \"REDACTED\"", "source_title": "Understanding Amazon Bedrock AgentCore Gateway CloudTrail events", "source_url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.html", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Yes", "detail": "Every CloudTrail entry carries identity information about the requester. Gateway data events additionally carry the JWT claims presented by the caller, including sub, scope, and issuer, in additionalEventData.", "quote": "Every event or log entry contains information about who generated the request.", "supporting_quote": "Using the information collected by CloudTrail, you can determine the request that was made to Amazon Bedrock, the IP address from which the request was made, who made the request, when it was made, and additional details.", "source_title": "Monitor Amazon Bedrock API calls using CloudTrail", "source_url": "https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Tamper evidence documented", "detail": "CloudTrail log file integrity validation is the only cryptographic tamper evidence mechanism documented across the reviewed platforms. It hashes each delivered log file with SHA-256 and signs hourly digest files with SHA-256 with RSA. It must be enabled on the trail. Storage duration is a property of the destination bucket the customer chooses.", "quote": "To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation.", "supporting_quote": "This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing.", "source_title": "Validating CloudTrail log file integrity", "source_url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "Partly", "detail": "Tool names and caller identity arrive natively in CloudTrail data events. Richer span data, and the tool arguments CloudTrail redacts, come from AgentCore Observability, where several signal types require explicit enablement and deeper spans require instrumenting the agent code.", "quote": "Signals marked with an asterisk require explicit enablement.", "supporting_quote": "By instrumenting your agent code, you can also gather more detailed trace and span data as well as custom metrics.", "source_title": "Amazon Bedrock AgentCore generated observability data", "source_url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-service-provided.html", "retrieved": "2026-07-28" } }, "incident_responder_note": "With gateway data events enabled you can prove that a specific token holder invoked a specific named tool at a specific time, and validate that the log file was not altered afterwards. You cannot read the arguments out of that record, because the documentation says they are redacted. Recovering the arguments means a second, separately configured source." }, { "platform_id": "mcp-specification", "platform_name": "Model Context Protocol specification", "vendor": "Model Context Protocol (open specification)", "spec_version": "2025-11-25 (current protocol version)", "audit_surfaces_reviewed": "Server tools, server utilities logging, and security best practices sections of specification revision 2025-11-25.", "cells": { "native_audit_log": { "value": "Not defined by the specification", "detail": "The protocol defines a logging utility for servers to send structured diagnostic messages to clients at syslog severity levels. It defines no audit log, no audit record schema, and no retention requirement. Clients MAY persist log messages; nothing requires them to.", "quote": "The Model Context Protocol (MCP) provides a standardized way for servers to send structured log messages to clients.", "supporting_quote": "Servers that emit log message notifications **MUST** declare the `logging` capability:", "source_title": "Logging (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/logging", "retrieved": "2026-07-28" }, "tool_calls_recorded": { "value": "Invocation is defined as a protocol message. No audit record is defined.", "detail": "The specification defines how a model discovers and invokes tools and requires a human to be able to deny invocations. Whether an invocation is recorded anywhere, and for how long, is left entirely to the implementation.", "quote": "The Model Context Protocol (MCP) allows servers to expose tools that can be invoked by language models.", "supporting_quote": "For trust & safety and security, there **SHOULD** always be a human in the loop with the ability to deny tool invocations.", "source_title": "Tools (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/server/tools", "retrieved": "2026-07-28" }, "tool_arguments_captured": { "value": "Arguments are carried in the request. Persistence is not defined.", "detail": "A tools/call request carries a name and an arguments object. The specification says nothing about recording either one. Any argument-level evidence is a property of the host application or the gateway in front of the server, not of the protocol.", "quote": "Tools in MCP are designed to be **model-controlled**, meaning that the language model can discover and invoke tools automatically based on its contextual understanding and the user's prompts.", "source_title": "Tools (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/server/tools", "retrieved": "2026-07-28" }, "human_principal_recorded": { "value": "Not defined by the specification", "detail": "The specification does not define a field that carries the human principal into a tool call. Its security guidance warns explicitly that token passthrough leaves the server unable to distinguish clients and makes investigation harder, and forbids accepting tokens not issued for the server.", "quote": "The MCP Server will be unable to identify or distinguish between MCP Clients when clients are calling with an upstream-issued access token which may be opaque to the MCP Server.", "supporting_quote": "Both factors make incident investigation, controls, and auditing more difficult.", "source_title": "Security Best Practices (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices", "retrieved": "2026-07-28" }, "retention_and_tamper_evidence": { "value": "Not defined by the specification", "detail": "No retention period, integrity mechanism, or non-repudiation requirement is defined. The logging section instructs that log messages MUST NOT contain credentials, personal identifying information, or internal system details, which is a data minimisation rule rather than an evidentiary one.", "quote": "Log messages **MUST NOT** contain:", "source_title": "Logging (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/logging", "retrieved": "2026-07-28" }, "customer_instrumented": { "value": "By definition, yes", "detail": "Because the protocol defines no audit log, every audit trail over MCP traffic is supplied by the host application, the client, the server implementation, or a gateway. Scope design guidance in the specification notes that broad scopes obscure audit trails.", "quote": "Poor scope design increases token compromise impact, elevates user friction, and obscures audit trails.", "source_title": "Security Best Practices (Model Context Protocol specification 2025-11-25)", "source_url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices", "retrieved": "2026-07-28" } }, "incident_responder_note": "Nothing can be reconstructed from the protocol alone. If your agents reach internal systems through MCP servers, the evidence you will have in an incident is whatever the host, the server, or the gateway in front of them chose to write down." } ], "documentation_gaps": [ { "platform_id": "openai", "gap": "Compliance API event coverage, schemas, filters, and retention", "detail": "The public Compliance API page states that the authenticated Admin API reference at chatgpt.com/admin/api-reference is the source of truth for event coverage, schemas, filters, and retention. That reference returned HTTP 403 to unauthenticated retrieval on 2026-07-28. The ChatGPT Enterprise compliance help article at help.openai.com also returned HTTP 403 to automated retrieval on the same date. Those cells therefore report the limits of public documentation, not the limits of the product.", "retrieved": "2026-07-28" }, { "platform_id": "microsoft-foundry", "gap": "Per-tool-call audit record type", "detail": "Microsoft publishes a ToolCalls platform metric with AgentId and ToolName dimensions in the Foundry Agent Service (classic) monitoring reference, which is a counter rather than a per-call record. The classic agents surface is documented as deprecated with retirement scheduled for 2027-03-31, so it was not used as the basis for any cell in this matrix.", "retrieved": "2026-07-28" } ], "revision_log": [ { "version": "1.0.0", "date": "2026-07-28", "change": "Initial publication. Six platforms reviewed across six dimensions, 36 cells, every populated cell carrying a verbatim quotation from published vendor documentation retrieved on 2026-07-28." } ] }