Topic starter
14/05/2026 1:49 pm
TL;DR: Teleport says DORA assessors evaluate operating effectiveness, not static policies, and agentic AI makes proof harder because autonomous actions require identity-traceable logs, contextual evidence, and continuous monitoring. The compliance burden shifts from documenting controls to proving that humans and agents stayed within approved scope at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Guide: DORA Compliance Evidence for Agentic AI”.
Key questions
Q: What breaks when DORA evidence relies on policies instead of runtime logs?
A: Policies prove intent, not execution.
Q: Why do AI agents make DORA audit evidence harder to prove?
A: AI agents can choose actions dynamically and act through delegated or shared credentials, which weakens the normal human-based audit chain.
Q: How do security teams know if DORA control evidence is actually working?
A: Control evidence is working when it can be regenerated from live telemetry, not manually reconstructed for an audit.
Practitioner guidance
- Implement identity-linked evidence chains Record every elevated action with the identity, approval context, duration, and command-level activity so auditors can reconstruct the full session.
- Correlate logs across identity and infrastructure layers Aggregate network, application, host, and identity events into one traceable record that can explain how an incident or privileged session unfolded.
- Capture agent decision telemetry Store the prompt, plan, tool choice, and execution result for each AI agent action so the audit trail shows why the action occurred.
Bottom line: DORA evidence is about proving control operation, not preserving a policy library.
What's in the full article
Teleport's full guide covers the operational detail this post intentionally leaves for the source:
- Control-by-control evidence mapping for the five DORA pillars
- Examples of timestamped logs, session records, and classification artefacts
- Agent-specific telemetry patterns for proving what an AI system actually did
- Practical guidance for building a unified audit trail across third parties and internal systems
👉 Read Teleport's guide to DORA evidence for agentic AI and audit trails →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/05/2026 1:49 pm
DORA evidence has moved from control inventory to proof of runtime behaviour. The article makes a clear distinction between having a framework and proving that the framework worked under real operational conditions. That shift matters because assessors are no longer satisfied by static control statements when logs, timestamps, and approvals can demonstrate actual execution. For practitioners, the lesson is that compliance evidence has become a live control surface, not a documentation exercise.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations tell whether an AI agent is acting outside its intended scope?
A: Organisations should look for behaviour that crosses expected tool boundaries, generates unusual credentials, or chains actions across systems that are not part of the original task. The signal is not simply high activity. It is a change in action pattern, delegation, or downstream access context.
👉 Read our full editorial: DORA evidence for agentic AI demands identity-traceable audit trails
This post was modified 6 days ago by NHI Mgmt Group