Who is accountable when an organisation cannot reconstruct LLM usage for audit or incident review?

Accountability usually sits with the platform, security, and application owners together, because governance failures span identity, routing, logging, and policy enforcement. If the organisation cannot reconstruct usage, the gap is not just a logging issue. It is a control design issue that should be treated as a shared ownership problem with clear operational responsibility.

Why This Matters for Security Teams

When an organisation cannot reconstruct LLM usage for audit or incident review, the problem is larger than missing logs. It means the control plane cannot answer basic questions about who invoked the model, which data was exposed, what tools were called, and whether output was acted on. That creates gaps in accountability across security, platform, and application ownership, especially where LLMs sit inside workflows with multiple integrations.

This is not a theoretical concern. Current guidance from the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026 treats traceability and governance as core security properties, not afterthoughts. NHIMG research on AI agents as a new attack surface shows only 52% of companies can track and audit the data their AI agents access, leaving nearly half with a blind spot during breach investigation. In practice, many security teams discover that reconstructability failed only after legal, compliance, or forensics asks for evidence that no one can confidently produce.

How It Works in Practice

Accountability should be assigned to the teams that own the controls needed to reconstruct usage, not just the incident itself. Platform owners typically operate the logging, routing, and telemetry layer. Security owners define the policy, retention, and investigative requirements. Application owners ensure prompts, tool calls, and downstream actions are instrumented in the workflow. If any one of those layers is missing, the audit trail becomes partial and forensic value drops sharply.

For LLM systems, reconstruction usually depends on four linked capabilities:

• Request-level identity for the user, service, or agent that initiated the action.
• Immutable logs for prompts, outputs, tool calls, model version, and policy decisions.
• Correlation IDs that tie front-end activity to backend execution and external data access.
• Retention and access controls that preserve evidence without exposing sensitive content broadly.

For agentic environments, this must extend to workload identity and runtime authorisation. Guidance from the OWASP NHI Top 10 and the CSA MAESTRO agentic AI threat modeling framework reflects the same pattern: if the system cannot prove what executed, when, and under which policy, then ownership is incomplete. A useful operational model is to treat the audit trail as a security control with named owners, tested recovery procedures, and evidence requirements for both normal operations and incident review. These controls tend to break down when LLMs are embedded in shadow IT workflows or third-party integrations because no single team controls the full execution path.

Common Variations and Edge Cases

Tighter reconstruction requirements often increase engineering and storage overhead, requiring organisations to balance forensic value against data minimisation, latency, and privacy constraints. That tradeoff matters because not every environment can retain full prompt and output content indefinitely. Current guidance suggests risk-based logging, with richer capture for high-impact workflows and shorter retention for lower-risk interactions.

There is no universal standard for this yet, especially in regulated or multi-tenant environments. Some teams log full payloads, while others store hashed prompts, redacted content, or policy decision metadata only. The right answer depends on whether the organisation needs to support legal discovery, safety review, fraud investigation, or model abuse analysis. For agentic systems, a missing join between the agent identity, the tool call, and the downstream effect is often more damaging than missing the raw text itself. That is why the NIST Cybersecurity Framework 2.0 remains relevant: governance, detection, and response all depend on evidence quality. In higher-risk deployments, the right answer is usually to redesign the workflow so reconstruction is automatic, not manually assembled after the fact.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• When should organizations review their NHI policies?
• When should organizations review access controls?