Audit Trails for Agents: Minimum Viable Spec

An audit party from the Comptroller and Auditor General asked a simple question in a state directorate: why did this draft sanction go to the officer with these numbers? The agent had been live for five months. The product could show a chat. It could not show which retrieval set had been used, which tool had read which table, whether a human had approved the send, or which model hash had been running on that Tuesday. The directorate produced screenshots. Screenshots are not a trail. The query became a finding about the system, not only about one sanction.

CAG, under the Comptroller and Auditor General's (Duties, Powers and Conditions of Service) Act, 1971, audits government expenditure, receipts and the systems that produce them. Agents that move or draft public money, benefits, or legally relevant text are inside that interest. This article is the minimum viable trail so a later auditor — CAG, internal, or a court-facing officer — can reconstruct a decision. It is not a full ISMS and not a claim that CAG has issued an AI standard. It is the field spec we write into contracts so the reconstruction is possible.

CERT-In's 180-day ICT log duty is a floor on retention and location, not the whole design. DPDP, as it commences, will care that you can support principal rights and security. Administrative law cares that a reasoned decision can be explained. Put those together and you get seven fields. Miss one, and the story has a hole.

Not legal advice and not an audit opinion.

The seven fields

Who: the human identities and the service identities. Officer, approver, vendor support user, model runtime, retrieval job. Shared inboxes are a finding.

What tool: the allow-listed action — read table, draft noting, send SMS, open ticket. A free-text 'the agent did something' is not a tool name.

What data class: grievance body, identity document, financial entitlement, public circular. Classes let you prove that a scholarship file did not go to a hosted overflow.

Why: the purpose tag and the triggering event. Purpose limitation is not a recital if the trail cannot show it.

Approval: which human gate fired, under which delegation, or an explicit record that no gate was required for this class.

Output: the bytes or a hash of what left the agent — the draft, the API payload, the citizen-facing text.

Override: whether a human edited or rejected, and the before/after. An agent that cannot show a reject did not have a loop. It had a suggestion box.

Minimum viable. You may add more. You may not drop these and call the product auditable.

Field	Example value	Fail if
Who	officer: IN/123; runtime: agent-sanctions-v3	admin / shared inbox / missing service id
What tool	read:entitlements_v2 ; draft:sanction_note	'completed the task'
What data class	financial_entitlement; public_circular	No class, or 'customer data'
Why	purpose:first_draft_sanction; trigger:file_no	Empty, or a marketing campaign id
Approval	undersec_id + DFPR/local delegation ref / not-required:class_X	Silent send on a class that needed a gate
Output	hash of noting; destination queue	Chat UI only, no stored output
Override	rejected; fields changed: amount	No reject path, or reject not logged

Reconstructable, not explainable-theatre

You do not need a mystical story about neurons. You need to replay the tokens of the process: this officer, this hash, these documents, this tool, this gate, this text. A vendor 'explainability module' that produces a paragraph of English and no fields is theatre. A dry JSON that a section officer can open in ten years is the spec.

Keep the model hash and the prompt/policy version in the same record. Tuesday's agent is not March's agent. Auditors will ask about the Tuesday.

Retention and location

Land the trail in a store the department controls. Retain at least 180 days in Indian jurisdiction to sit with CERT-In practice, and longer where expenditure, benefits or court-facing processes need it. Do not keep the only copy in a vendor SaaS abroad. Do not keep it only in a chat product that expires in thirty days.

The trail will contain personal data. It is in scope for the DPA, the training ban, and erasure — with the usual tension between erasure and audit holds. Write that tension. Do not let a vendor resolve it by deleting the evidence.

• Immutable write, time from a sane clock.
• Queryable by file number, officer, tool, data class.
• Export without the vendor in the room.
• Hash-chained or otherwise tamper-evident enough for your CISO.

How to put it in the contract

Attach the seven-field schema. Make a sample record a bid annexure. Make a reconstruct-this-file drill part of go-live. Fail the bid if the product can only show a chat.

Point evaluators at the companion security annexure for landing zone and CERT-In clocks. This spec is the payload. That annexure is the pipe.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

This is too much volume. We will drown in logs.

You will drown if you log token-by-token chatter and never index it. You will not drown if you log the seven fields per material action and index by file number. Volume is a design problem, not a reason to have no trail.

Explainability features already cover this.

Ask them to emit the seven fields. If they emit an essay, they cover a demo, not an audit.

CAG has not mandated this schema.

CAG mandates reconstructable public expenditure and systems. This schema is how an agent becomes reconstructable. Waiting for a specific CAG AI format is how you fail a general audit.

Erasure rights will force us to delete the trail.

That is a counsel problem: holds, minimisation, and what can be retained as a lawful record. It is not a reason to never write the trail. Write both duties.

A twenty-day trail you can go live on

Do not wait for a perfect data lake. Land the seven fields in the SIEM or an append-only store you already trust.

1. Days 1–5: map material actions. If an action can move money, benefits, or external text, it is material.
2. Days 6–10: freeze the schema. Demand a sample record from the vendor.
3. Days 11–15: land in your store. Prove query by file number.
4. Days 16–20: reconstruct three real files end-to-end. If you cannot, you are not live, whatever the ceremony says.

How this shows up in the file

The note says the agent will not go live without a reconstructable seven-field trail in a department store, retained to the longer of CERT-In practice and our expenditure retention. A chat UI is not accepted as the record.

Attach one reconstructed sample. Auditors understand samples.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How this survives CAG, RTI or the Board

“Audit Trails for Agents: Minimum Viable Spec” is not a workshop slide. A P6 Compliance/DPO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

If a CAG party cannot reconstruct who called which tool on which data class, why, with whose approval, what went out, and whether a human overrode it, you do not have an agent you can defend. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI agent audit trail” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Audit Trails for Agents: Minimum Viable Spec” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI agent audit trail” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.