AI Agent Audit Trails: Replayable Monitoring in Production

A customer service Agent running in production once executed the same refund operation twice. The user noticed. I didn't — and by the time I caught on, I'd burned an entire afternoon on "archaeology": digging through logs, trying to answer a question that sounds simple: what did this Agent actually do, in what order, and why?

The logs had API call records, but no narrative thread — no Agent plan, no parameter context for tool calls, no intermediate reasoning that made the fourth call seem reasonable at the time. Reconstructing the process from scattered logs, the best I could come up with was: "It probably looped, probably harmless, but I can't fully rule out other possibilities."

That lesson gave birth to AgentWatch: a monitoring tool built specifically for Agents in production. The core idea is straightforward — if an Agent does something wrong at 3 a.m., how long until a human knows? And once they know, how long until they figure out what it actually did?

Three failure modes nobody alerts on

Traditional APM can't catch Agent problems, because none of them look like an "error."

Loops: The Agent repeatedly retries a failed action, burning money each time, possibly with side effects. No abnormal status codes, no crashes — just a rising bill.

Drift: Model output characteristics gradually shift over weeks — a model version change, prompt entropy shifting, or something else — and by the time behavior is clearly off, nobody can say which day it started.

Anomalies: The Agent does something that's reasonable in isolation but wrong in aggregate. Double refunds are the classic case: one refund is legitimate, two is a bug.

These three failure modes share a common trait: the logs are all "normal," but the result is wrong. According to the OWASP Top 10 for LLM Applications, "Excessive agency" is one of the core risks for LLM applications, and audit logging is the primary detection control.

Traditional APM (Application Performance Monitoring) is a class of tools for monitoring the operational state and performance metrics of software systems, with typical representatives like Datadog and New Relic. Its design assumption is that system behavior can be reduced to a finite set of error patterns: failed requests, response timeouts, resource exhaustion, thrown exceptions. These signals all have clear thresholds and status codes, and ops teams alert on them accordingly.

This paradigm works very well for deterministic systems, but it falls short for Agents. An Agent's API calls may each return 200, latency is normal, token consumption is within budget — in other words, every traditional metric is green. The problem lies at the sequence level: whether the order of calls, the number of repetitions, and the combination of parameters form a reasonable whole. This is a structural judgment that spans requests and time, whereas traditional APM's monitoring granularity is the single request — it's inherently blind to this layer. So Agent failures aren't "some metric exceeded its limit" — they're "every metric is correct, and the result is entirely wrong," requiring a new abstraction layer to capture.

When you monitor for Agents, what are you actually monitoring?

AgentWatch watches exactly those three categories: loop detection, drift alerts, anomaly flagging — plus one key capability: a replayable audit trail.

Replayability deserves its own discussion. Debugging without replay is essentially solving a case from memory: you know something went wrong, you're holding fragments, and the causal chain is always a guess. With replay, that double refund went from "an afternoon" to "ten minutes" — you directly query "what did it do," instead of "what do I think it might have done."

The author is an independent developer, and these numbers come from his own production deployment: replayable audit trails made incident root-cause analysis 4.2x faster; production Agent loops were 100% captured within 60 seconds, with zero manual alerts; and undetected retry loops were eliminated, saving over $12k per year in token costs.

The sample size behind these numbers is limited, but the problem they point to is very real: when Agents act autonomously in production, "we checked the logs" is becoming a board-level non-answer.

The key difference between a replayable audit trail and ordinary logs lies in completeness, ordering, and context. Ordinary logs are scattered, passive, and ops-oriented; audit trails are structured, recorded in causal order, and oriented toward post-mortems and compliance.

Specifically, a replayable trace needs to record: the Agent's planning intent at each step, the full parameters of each tool call, the results returned by tools, and the next-step decisions made based on those results. It reproduces the "decision chain," not just the "call list." This is exactly the point the article emphasizes — without replay, root-cause analysis can only rely on fragments and memory-based guesswork; with replay, you can directly answer "what did it do, in what order, and why."

From a compliance perspective, this is also why OWASP lists "audit logging" as the primary control for detecting "excessive agency" risk: as Agent autonomy rises, audit trails become the only mechanism capable of reconstructing the chain of accountability after the fact. It isn't an accessory to monitoring — it's core infrastructure for Agent observability.

What AgentWatch is not

The tool's boundaries are clear, and the author draws them himself:

It monitors, it doesn't fix. Loop detection alerts don't mean your architecture has retry limits. If no one is responsible for responding, alerts are just noise.

Audit trails only cover instrumented paths. What the Agent does outside your system can't be traced.

"Anomaly" is a statistical judgment, not a moral one. Expect false positives in the first few weeks after going live; tuning is required. Anomaly doesn't mean malice.

These limitations give AgentWatch a clear positioning: it's a detective tool, not a police officer. It can tell you what happened, but it can't decide for you what to do about it.

Questions to ask in your next incident post-mortem

Not "was it the Agent?" but two harder questions:

If the Agent does something wrong at 3 a.m., how long until a human knows? And once they know, how long until they figure out what exactly went wrong?

If the honest answer to both questions is "nobody knows," then audit trails are where you should start. AgentWatch is free to try — plug in one Agent and see what its first week of behavior looks like once you can actually replay it.

The urgency here is this: the higher the Agent's autonomy, the wider the gap in "explainability" and "traceability." Traditional observability tools were designed for deterministic systems — request comes in, gets processed, returns, gets logged. Agents are different: they plan in the middle, call tools, adjust strategy based on results. Every step is reasonable, but the sequence can be fatal.

In other words, Agent observability needs a new abstraction layer: not "which request failed," but "why did this decision sequence lead to that outcome." Replay capability is the core of that abstraction layer. Without it, every Agent incident is irreproducible — and an irreproducible problem is an unsolved problem.

One-line Summary

Production Agents need replayable audit trails, because traditional APM can't catch the three silent failure modes: loops, drift, and anomalies.

Paragraph Summary

A developer, after an unnoticed double-refund incident forced him to spend an afternoon doing "archaeology" in scattered logs, built AgentWatch. Traditional APM can't catch Agent failures: retry loops (burning money, no errors), behavioral drift (slow shift, no start date), and anomalous actions (reasonable alone, wrong together). AgentWatch focuses on loop detection, drift alerts, anomaly flagging, and replayable audit trails — cutting root-cause analysis from an afternoon to ten minutes (4.2x faster), catching production loops 100% within 60 seconds, and saving $12k+ in token costs per year. It monitors rather than fixes, only covers instrumented paths, and treats anomalies statistically, not morally. The core question: when an Agent errs at 3 a.m., how long until you know — and how long until you understand?