The audit trail breaks because the summary removes the identity, tool use, and decision context of each delegated action. Security teams lose the ability to prove who did what, what systems were touched, and whether a blocked action slipped through in a subordinate layer. The final answer may be accurate, but it is not sufficient evidence.
Why a summary is not an audit record
An AI agent summary is a narrative layer, not a forensic one. It compresses steps, omits rejected branches, and usually strips out the metadata needed to reconstruct delegated authority. Once that happens, the record can still read plausibly, but it no longer supports accountability, replay, or reliable incident review.
That distinction matters because the audit question is not whether the outcome sounds reasonable. It is whether the record preserves enough evidence to answer who acted, under what authority, through which tool path, and with what intermediate decisions.
When AI agents are involved, the audit record has to preserve the chain of delegation, not just the final answer. A summary that leaves out tool invocation details or policy decisions turns a sequence of machine-mediated actions into a single assertion, which is too coarse for governance or investigation.
What disappears when you keep only the summary
The first thing that disappears is attribution. If the summary does not preserve the acting principal, the invoked tool, and the request context, teams cannot distinguish an authorised action from a delegated one or a compromised one.
The second loss is decision provenance. Summaries often collapse “considered, blocked, retried, approved, or bypassed” into a single endpoint. That makes it impossible to tell whether the agent followed policy, whether a subordinate layer overrode it, or whether an unsafe action succeeded despite a higher-level denial.
The third loss is scope. A summary may say what happened, but not what systems were touched, what data was exposed, or which side effects occurred. For auditability, the important detail is not just the end state, it is the blast radius.
For readers building controls around delegated AI action, the practical issue is not whether the summary is human-readable. It is whether the underlying evidence survives in a form that can be queried, correlated, and retained independently of the model’s own interpretation. NHIMG’s AI Agent Observability, Audit and Incident Response Guide addresses the logging and attribution layer that summaries tend to lose.
What an audit-grade record needs instead
An audit-grade record should capture the original request, the acting identity, the policy decision, the tool or system called, the input and output hashes or references where appropriate, and any approval or denial that shaped the action. The point is not to log everything verbatim, but to preserve enough structure to reconstruct the control path.
That also means storing records at the point of action, not only at the point of summarisation. If the summary is the only retained artefact, the organisation has delegated its evidence model to the same layer that may have misunderstood or simplified the action in the first place.
Where agent authority is dynamic, the record should show when privilege was granted and when it was removed. A summary that omits that timing hides whether an action happened under standing access, temporary elevation, or an exception path. NHIMG’s AI Agent Authorisation Guide is useful here because it frames per-action authority and just-in-time access as the control model, not as an implementation detail.
When multiple tools or services are involved, the audit record should preserve the intermediate hops, not just the final output. That is the difference between a trace and a story. A story may be accurate in broad terms, but a trace is what supports verification, exception handling, and post-incident reconstruction.
Why this becomes a governance problem, not just a logging problem
Once summaries are treated as records, organisations start trusting a layer that was designed to abstract, not to attest. That creates a governance gap: the business believes it has evidence, while security and audit teams are left with a convenience artefact that cannot prove control effectiveness.
This is especially risky when AI systems can act across multiple tools, environments, or approval layers. A summary can hide a blocked action that was retried in another path, or a tool call that succeeded after an earlier denial. That makes exceptions, abuse, and policy drift much harder to detect.
The deeper issue is that the summary can become a single point of failure for accountability. If the model misstates the action, or omits a subordinate step, the organisation may still have a clean-looking record that is materially incomplete. That is a governance failure because the control objective is evidence, not prose.
For this topic, the relevant external lens is identity, delegation, and authorisation around agent action. RFC 8693: OAuth 2.0 Token Exchange is a useful reference because it formalises delegated and on-behalf-of flows that summaries must not erase. OWASP Agentic AI Top 10 also captures the identity and privilege abuse problem that appears when agent action is not separately evidenced from its narrative summary.
Risk and Threat Considerations
When the summary becomes the record, the main risk is evidentiary loss: the organisation may be unable to prove what the agent actually did, especially if an unsafe tool call was later normalised into a harmless-looking narrative. That weakens incident response, audit defensibility, and post-incident accountability.
Failure mechanism: The summarisation layer collapses delegated actions, hides rejected or blocked steps, and strips the identity and tool context needed to reconstruct the action chain.
Impact: Security teams lose trustworthy provenance, cannot reliably investigate suspected misuse, and may miss policy violations that occurred in subordinate layers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Summaries can hide delegated authority and privilege use in agent actions. |
| ASI02 — Tool Misuse | The question concerns lost tool-use context in agent summaries. | |
| ASI09 — Human-Agent Trust Exploitation | Summaries can create false confidence that the agent's output is complete evidence. | |
| Recommendation — Record per-action identity and privilege state for every agent decision. Log each tool invocation and outcome as a separate auditable event. Keep human review separate from the machine record used for accountability. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Audit records must capture the events summaries tend to compress away. |
| AU-12 — Audit Record Generation | The issue is whether action evidence is generated at the source, not summarised later. | |
| IA-9 — Service Identification and Authentication | Agent actions depend on the identity behind the delegated tool or service call. | |
| Recommendation — Define and retain the specific events needed to reconstruct agent actions. Generate audit records at the point of action, before any summarisation layer. Bind each delegated action to the authenticated service or agent identity. | ||
Practitioner Guidance
What to verify: Check whether your retained records can answer four questions without consulting the model output: who acted, what tool or system was invoked, what policy decision was made, and what evidence exists for intermediate steps. If any one of those depends on the summary alone, the record is not audit-grade.
What practitioners underestimate: A summary can be useful for human review and incident triage, but it should never be the sole retained artefact for delegated action. The safest operating model is to treat the summary as a convenience view over an independent event trail, not as the event trail itself.
Practitioner takeaway: If the organisation cannot reconstruct the action chain from non-summarised evidence, it does not have an audit record, it has a narrative.