Logging Standards for Autonomous Actions

The integrator opened the vendor's 'full observability' dashboard in a state data centre cage. There were traces, token counts, a flame graph, and a cheerful latency heatmap. The CISO asked a smaller question: show me the last time the agent called the land-records API. The dashboard showed a span named tool_call. It did not show which service account, which khata number class, which purpose, which officer had approved that class of call, what JSON came back, or whether anyone overrode the draft that followed.

Observability is not an audit log. Product analytics is not an audit log. A packet capture of TLS to a tool host is not an audit log. An autonomous action is a government act wearing an API. It needs the same seriousness you already give to a treasury voucher: who, when, on what authority, touching which record, producing what, corrected by whom.

This is a template for system integrators, SDC owners and departmental CISOs who must instrument an agent that can retrieve, draft or call tools. It is written on 16 August 2026. It is not a CERT-In notification and not legal advice. It is the minimum field list we refuse to ship without. Prcept AI deploys on-prem and air-gapped, is DPIIT recognised, and does not train on customer data. The log still belongs to you.

Eight fields, or the action does not fire

Treat the field list as a precondition, not as a report you generate later. If the runtime cannot stamp the eight, it should refuse the tool. That is how you stop a helpful agent from becoming an unlogged clerk.

Minimum viable action log for a government agent. Extend, do not shrink.

Field	What good looks like	What usually arrives instead
Who	Named officer ID or named service account tied to a workflow	shared_admin or the vendor's support user
When	UTC plus IST, clock sourced from NIC/SDC, skew alarmed	Container local time that drifts over a weekend
Tool	Registered name and version of the API or RPA object	A generic http.post span
Data class	Departmental class: public / personal / identity / financial / child / secret	Silence, or 'customer data'
Purpose	Tag that matches the [AI register](/blog/building-an-ai-register-for-your-department) and the notice to the citizen	The model guessed a purpose from the prompt
Approval	Standing approval ID or a just-in-time officer grant	The agent is approved in principle
Output	Hash or object ID of what was written or proposed	A truncated chat bubble
Override	Empty, or officer ID plus reason code	A later WhatsApp that never joins the row

Add correlation identifiers so a CAG party or a PIO can pull one case. Add a integrity stamp — HMAC or a department key — so a later editor cannot tidy the row. Ship a copy to the SIEM the department already operates. Keep a copy the application owner can export without a SOC ticket for every RTI.

CERT-In is the floor, not the schema

The directions dated 28 April 2022 require covered entities to enable logs of ICT systems, maintain them for 180 days, keep them available in Indian jurisdiction, synchronise clocks, and report specified incidents on a short clock. FAQs issued in May 2022 discuss copies and scope. Read the live PDFs on cert-in.org.in before you write a tender clause. Do not quote a blog.

Those directions were written for cyber incidents, not for speaking orders. They still help you: Indian jurisdiction for the store, disciplined clocks, a retention floor, a reporting muscle. They do not tell you to record purpose tags. They do not tell you to bind a tool call to a DFPR-competent officer. That is your departmental schema. Write it.

Air-gapped deployments still log. An air gap that writes nothing is not sovereign. It is mute. Media-transfer the SIEM export if the SIEM sits in a connected enclave. Do not invent a weekly USB of raw chats without a chain of custody. The companion piece on immutable logs without blockchain is the integrity design.

What not to log, and why that is also a standard

A standard that says log everything will produce a warehouse of passwords, full Aadhaar numbers, and other citizens' grievances, and then someone will file an RTI for the warehouse. Purpose-limit the payload. Log that a field of class identity was sent, not the identity number, unless a statutory reconstruction truly needs the number and the store is locked to that purpose.

Do not log raw prompts that contain pasted case files if you can log a handle to the case in the system of record. Do not ship those prompts to a vendor analytics tenant. Do not train on them. Prcept will not. A competitor who needs your prompts to 'improve quality' is asking to become an undeclared processor of your worst days.

• Secrets: tokens, passwords, OTP, session cookies — never.
• Full identity numbers: prefer last-four plus a case handle, unless reconstruction requires more and access is ticketed.
• Children's data: extra refusal, extra lock, extra short retention.
• Vendor telemetry that leaves the perimeter: off, proven off, packet-captured off.

Two implementations, one API

Objections from the implementation room

The developer says eight fields will add latency. Answer: stamping a structured row is cheaper than a model token. If you cannot afford a row, you cannot afford a tool.

The vendor says their platform is already ISO 27001. Answer: that certificate does not put purpose tags in your mutation log. Ask for the schema, the export, and the dark-VM test.

The DPO says more logs mean more personal data. Answer: then minimise the payload and lock the store. Deleting the who/when/tool row is how you fail both CERT-In and CAG.

Operations says we will turn logging on after go-live. Answer: an unlogged week of autonomous actions is a week of unreconstructable government. Refuse the go-live.

A four-week playbook for the integrator

• Week 1: write the eight-field schema into the contract and the ICD. No tool is registered until it can stamp the eight.
• Week 2: wire the SIEM the department already owns. Prove Indian jurisdiction of the store. Prove clock source.
• Week 3: run three tools in staging. Export a case packet without vendor identity. Fail any tool that cannot.
• Week 4: tabletop a CERT-In 180-day retrieval and an RTI extraction. Write the retention line so chats do not outlive their purpose.

File note you can paste

Subject: Minimum logging standard for agent tool calls.

No agent in this department shall invoke a tool unless the runtime can record, in a store we control: actor, time, tool and version, data class, purpose tag matching the AI register, approval reference, output identifier, and override if any. A copy shall land in the departmental SIEM. Clocks shall follow the SDC source. Retention shall meet the CERT-In 180-day floor and shall not exceed the purpose and the record schedule without a written reason.

Payloads will be minimised. Secrets will not be logged. Vendor telemetry that leaves the perimeter is prohibited. This note is an internal aid. It is not legal advice.

How the integrator proves the schema, not the dashboard

Acceptance is three failed-or-passed calls in staging, exported as packets the department opens without your laptop. Call one: a land-read that stamps all eight fields. Call two: a payment-adjacent tool that must refuse and still stamp a refusal row. Call three: a clock-skewed node that must alarm rather than write a silent lie. If any of those three needs you on a screen-share, the schema is not theirs.

Map each field to a SIEM index before go-live. 'It is in OpenTelemetry somewhere' is how March disappears. Name the index. Name the retention on that index. Name who can query it without a vendor account. Write those three names on the ICD. The CISO will thank you once, when CERT-In or CAG asks, and never again, which is the correct amount of thanks.

Service accounts need joiners-movers-leavers too. An agent identity that outlives the workflow is a ghost clerk. Rotate. Kill. Log the kill. The eight-field row that says who, when the who is a key taped under a keyboard, is a forgery the department will own.

Air-gapped sites still need a media path for the SIEM copy if the SIEM sits outside the gap. Hash the export, two-person carry, same discipline as a model-weight bag. A USB of raw chats in a backpack is not a logging standard. It is a transfer of personal data with a handle.

• Refuse to register a tool whose owner cannot name the data class it will touch.
• Refuse a go-live whose first week will be 'logging later'.
• Keep a one-page field dictionary so two vendors do not invent two words for purpose.

Informational field guidance, not a CERT-In direction or legal advice. Read the live 28 April 2022 PDF and your sector regulator before you freeze a schema.