Why do AI agents make DORA audit evidence harder to prove?

Why AI Agent Actions Are Harder to Evidence in DORA Reviews

AI agents change the audit problem because the decision path is no longer a simple person-to-action chain. Evidence has to show not just who approved access, but how the agent was authorised, what it was allowed to do, which tools it invoked, and whether the recorded outcome really matches the action taken.

That matters for DORA because operational resilience evidence must stand up to scrutiny after the fact, especially where delegated or shared credentials are involved.

What Breaks the Normal Human Audit Chain

Traditional audit evidence usually assumes a stable human operator, a clear approval point, and a relatively direct path from intent to execution. AI agents weaken that model because they can select actions dynamically, chain tool calls, and reuse credentials or tokens without a one-to-one human record for each step.

Once an agent can act across multiple systems, the evidence problem becomes one of attribution and boundary control. It is not enough to show that a user launched the agent. You also need proof of the agent’s authority at the moment of each action, not just at login or deployment.

That is why the most useful evidence trail combines policy, identity, and runtime telemetry. The audit artefact should let a reviewer reconstruct the agent’s decision context, the request it received, the policy that allowed the step, and the downstream effect in the target system.

What DORA Expects Organisations to Be Able to Show

For DORA purposes, the practical test is whether the organisation can explain control, traceability, and accountability for operationally material actions. In an agentic workflow, this usually means linking the agent to a bounded authority model, keeping records of tool use, and preserving output that shows what the agent actually changed.

Evidence becomes stronger when it is time-bound and action-specific. A generic access report is weaker than a record that shows which tool the agent used, under which delegation rule, at what time, and with what resulting state change.

One useful way to think about the requirement is that the audit trail must connect the plan to the execution. If the plan is missing, the tool invocation is missing, or the result is detached from the authorised scope, the evidence chain is incomplete even if the action itself was legitimate.

Risk and Threat Considerations

AI agents create a provenance gap that can hide misuse, overreach, or accidental harm. When shared credentials, delegated tokens, or broad automation rights are used, an attacker or an internal failure can produce actions that are difficult to attribute cleanly after the event.

Failure mechanism: The organisation cannot prove which authority was exercised at the time of action, because the agent’s runtime decision, tool access, and downstream system change are not recorded as one coherent chain.

Impact: DORA evidence becomes weaker, incident reconstruction slows down, and the organisation may be unable to demonstrate control effectiveness, especially where the same credential can be reused across multiple actions or systems.

Practitioner Guidance

What to verify: Confirm that every material agent action can be reconstructed from four linked records, authority, plan, tool invocation, and outcome. If any one of those is missing, treat the evidence set as incomplete rather than “good enough”.

What to prioritise: Give the highest priority to agents that can trigger real-world effects, especially where they operate with delegated or shared credentials. Those are the flows most likely to create audit gaps and the hardest to explain during assurance review.

What good looks like: A reviewer should be able to take one agent action and trace it through policy decision, credential context, invoked tool, target object, and final state change without relying on narrative reconstruction from operators after the fact.

Practitioner takeaway: The core challenge is not logging volume, it is evidential linkage. If your controls can prove the agent was allowed to act, and exactly what it did, DORA auditability improves; if they cannot, the organisation is left with activity records that are informative but not defensible.

Related resources from NHI Mgmt Group

• Why do AI agents make non-human identity governance harder?
• How should organizations approach the governance of AI agents?
• How should security teams prove DORA compliance for AI agents that act autonomously?
• Why do AI agents make IAM and NHI risk harder to manage?