What tooling gives a CISO an audit trail of every agent action

You need an execution layer that records every model call, tool call, file change, and human approval an agent makes, ties each event to an identity, and keeps the record inside your own boundary. CreateOS is that layer: deploy, isolate, monitor, audit, and bill AI agents from one surface, in CreateOS cloud, your VPC, or fully on-premise.

Introduction

Most agent initiatives clear two of the three gates and stop at the third. Security review gets passed. The deployment boundary gets agreed. Then the CISO asks the question that ends the meeting: when this agent acts in production, who can tell me exactly what it did?

Chat transcripts cannot answer that. They show prompts and responses, not the tool the agent called, the system it changed, the policy that allowed it, or the person who approved it. The fix is structural: a record produced automatically, for every run, by the layer that executed the agent. Our post on what enterprises need to prove covers the reviewer's checklist. This piece is about the tooling that produces the evidence.

Key Takeaways

Every action, not every prompt: model calls, tool invocations, file and system changes, and the human approvals around them, per run.
Identity and authority: who deployed the agent, what it was permitted to do, and which policy allowed each action. Each agent is an identifiable principal, not a shared service account.
A record inside your boundary: your VPC or your data centre, with zero data retention by default.
Evidence a reviewer can open: live traces and usage dashboards, exportable for the audit file, not a log your team reconstructs after the fact.
Credentials your reviewer already trusts: SOC 2 Type II and ISO 27001, with reports available under NDA.

Why This Solution Fits

CreateOS is the governed execution layer underneath the agent tools you already build with. It is not another agent builder. Your teams keep their frameworks and their agents. CreateOS runs them and keeps the record.

Governance here means what your CISO means by it: identity, policy, authority, audit trail. The surface is framework-agnostic, so the record does not depend on which framework or model a team picked. Whatever wrote the agent, the trail reads the same to your reviewer.

Existing agents come too. Connect a vendor copilot or an internal build to the gateway and tool layer, and it keeps its logic while every run becomes a traceable, auditable record. No rebuild required.

The three gates get answered on one surface. Security review: SOC 2 Type II and ISO 27001, reports under NDA. Deployment boundary: CreateOS cloud, your VPC, or fully on-premise, with zero data retention by default. Accountability: the audit trail itself, covered next.

Key Capabilities

An immutable audit log. The log is append-only and exportable. Events cannot be edited out after the fact, and your compliance team can pull the artifacts it needs without filing an engineering ticket.

Per-run traces, live today. Every run produces a trace across model calls, tool calls, and approvals, with per-run token usage and failure detail. Traces and usage dashboards are live, not on a roadmap. Your reviewer reads the run instead of a summary of the run. For the mechanics, see our guide to tracing what an agent did across tool calls, model calls, and approvals.

Frozen permissions and named owners. Each agent deploys with an explicit, locked allowed-action list and a named owner. A tool vendor adding a capability does not silently grant the agent new powers. Shared accounts require admin sign-off and are flagged in the audit.

Approvals as durable pauses. A human-in-the-loop agent can pause mid-task, request approval, and resume when it gets an answer. The approval is part of the record, so an action a person signed off is distinguishable from one the agent took alone. Runs can be cancelled at any time.

Reproducible runs. Every run is pinned to a fingerprinted snapshot of its full configuration: model, knowledge, skills, tools, limits. When an auditor asks what the agent was running with that day, you replay the configuration instead of guessing.

A brake next to the record. Native observability comes with kill switch and rollback, and runtime guardrails fail closed: no guardrail, no answer. When a trace shows something wrong, stopping the agent is built in.

One surface for the full lifecycle. Deploy, isolate, monitor, audit, bill. Usage metering and billing sit on the same surface, so the record of what the agent did and the record of what it cost come from the same place. Where the code is untrusted or agent-written, CreateOS Sandbox runs it in its own Firecracker microVM.

Proof & Evidence

Ask for the walkthrough, not the deck. Traces and usage dashboards are live, so a demonstration should show a real run: model calls, tool calls, an approval, and the export.

The certifications are checkable. SOC 2 Type II and ISO 27001 reports are available under NDA, which fits the way security review already works.

The infrastructure has a history. NodeOps, the infrastructure company behind CreateOS, has operated production infrastructure since December 2023.

The customer pattern fits yours. CreateOS works with regulated and audit-heavy workflows, including a live healthcare customer we never name, and measures its engagements as time to first production agent. Proofs of concept run with forward-deployed engineering, delivered directly or through certified partners.

Buyer Considerations

Does the tool record tool calls and approvals, or only prompt and response text?
Where does the record live: the vendor's cloud, or your VPC and your data centre?
Can the trail show identity and authority per action, not just a list of events?
What stops an agent mid-run when a trace looks wrong, and can the run be rolled back?
Can your compliance team export the artifacts themselves, without a ticket?

One tradeoff belongs on the same list. CreateOS is opinionated: the governed surface is the product. If you need maximum self-host control with no governed layer, it is the wrong tool. If the goal is agents in production that your CISO can sign, it is the right one.

Frequently Asked Questions

What counts as an audit trail for an AI agent?

A complete one covers every model call, every tool call, every file or system change, and every human approval, per run, with identity and policy attached. Prompt logs alone miss what the agent did between prompts, which is where the risk lives.

We already built agents on our own stack. Does the audit trail still apply?

Yes. CreateOS sits underneath the builders and is framework-agnostic. Connect an existing agent to the gateway and tool layer, and it keeps its logic while every run becomes a traceable, auditable record.

Can agents run inside our own infrastructure?

Yes. CreateOS deploys in CreateOS cloud, your VPC, or fully on-premise, with zero data retention by default. The record stays inside the boundary you chose.

How do we get the compliance reports for our security review?

SOC 2 Type II and ISO 27001 reports are available under NDA. Raise it during the review, and the reports join the paperwork your process already expects.

Conclusion

The CISO's condition is reasonable, and it is a tooling question. An execution layer that records every action, inside your boundary, with reports your reviewer trusts, turns the accountability gate into a line item.

Bring the trace view to your next security review. Start at createos.sh or read the docs to see what a run trace covers.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.