Who is accountable for AI audit logging when organisations use both gateways and endpoint agents?

Why This Matters for Security Teams

AI audit logging is not a single control when organisations use both gateways and endpoint agents. A gateway can capture prompts and outbound tool calls, while an endpoint agent can see local files, browser sessions, desktop actions, and native integrations that never pass through the gateway. That split creates accountability gaps unless one team owns the full control model, review workflow, and retention policy.

This is why NHI Management Group treats logging as an operational governance issue, not a tooling checkbox. When logs are incomplete, teams lose the ability to reconstruct agent intent, prove data handling boundaries, or detect prompt injection and lateral abuse. The pattern is visible across incidents discussed in Top 10 NHI Issues and in current agent guidance from the OWASP Agentic AI Top 10.

Security leaders should assume that the real question is not who stores logs, but who can answer for missing events, sensitive body access, and retention failures across the whole AI stack. In practice, many security teams discover logging ownership only after an incident review reveals that the gateway captured one story and the endpoint agent captured another.

How It Works in Practice

Accountability should follow the control plane, not the log destination. In most mature setups, security or platform teams define what must be logged, how long it is retained, who can access sensitive prompt and response bodies, and how gateway records are correlated with endpoint telemetry. Product teams may own the agent workflow, but they should not be left to define evidence standards on their own.

Practically, teams need a logging design that treats gateway and endpoint data as complementary. The gateway is usually the first point for prompt ingress, model calls, tool orchestration, and policy enforcement. The endpoint agent adds local context such as user session state, clipboard activity, file access, and native app actions. Without a common event schema and shared identifiers, review teams cannot stitch together the sequence of actions. Guidance from the NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework both support this kind of cross-boundary accountability.

• Define a single logging owner for policy, retention, and review, even if multiple teams operate parts of the stack.
• Separate evidence logs from business content so investigators can review behaviour without overexposing sensitive bodies.
• Correlate gateway and endpoint events with shared request IDs, timestamps, and agent identities.
• Decide who can access raw prompts, tool outputs, and redacted views, then enforce that decision consistently.
• Test whether logs survive retries, offline execution, and local tool actions that bypass the gateway.

NHIMG research on LLMjacking: How Attackers Hijack AI Using Compromised NHIs shows how quickly identity abuse can turn into operational compromise when visibility is weak. These controls tend to break down when endpoint agents can execute offline or through unmanaged desktop tools because the gateway no longer sees the full action chain.

Common Variations and Edge Cases

Tighter logging usually increases storage, privacy review, and access-control overhead, so organisations must balance forensic value against data minimisation and regulatory exposure. That tradeoff becomes sharper when endpoint agents handle regulated content, developer secrets, or customer data.

There is no universal standard for this yet, but current guidance suggests three common patterns. First, some organisations place primary accountability with the platform team because it owns the logging pipeline and retention mechanics. Second, some assign shared accountability between security engineering and the AI platform owner, with formal sign-off from data protection or risk. Third, highly regulated environments may require an evidence owner separate from the operator to preserve independent review.

Edge cases matter. If the agent runs on a managed desktop, the endpoint team may own collection while security owns admissibility and review. If the agent uses a third-party gateway plus local extensions, the contract must specify which logs are mandatory and who receives them. If sensitive bodies are stored in logs, the access policy should be stricter than the model or application logs themselves. NHIMG guidance in The State of Secrets in AppSec reinforces how fragmented controls can undermine confidence even when teams believe coverage is strong.

For governance mapping, the strongest fit is OWASP Agentic AI Top 10 alongside zero trust logging principles in NIST Cybersecurity Framework 2.0. In practice, accountability becomes unclear when logs are split across vendors and teams, because no single owner can prove completeness end to end.

Related resources from NHI Mgmt Group

• Who should be accountable for proving that AI use in production is authorised and traceable?
• How should organizations approach the governance of AI agents?
• How can organisations govern AI agents that use service accounts and tokens?
• Should organisations allow AI agents to use hardcoded secrets?