Tool Audit Trail Generation Prompt Template

This prompt is designed for compliance officers, AI operations engineers, and platform security leads who need to generate structured, non-repudiable audit records for every tool invocation made by an AI agent. The job-to-be-done is converting raw agent-tool interaction logs into a formal chain-of-custody record that includes the actor, action, target, timestamp, arguments, result summary, and the authorization decision that permitted or denied the call. Use this when you are building an agent harness that must satisfy internal governance reviews, SOC 2 evidence collection, or regulatory requirements that demand a clear, immutable record of what the agent did and why it was allowed to do it.

The prompt template requires structured input context: the agent's session and user identity, the tool's full definition and permission scope, the exact arguments passed, the raw result, and the authorization decision metadata. It is not a real-time enforcement mechanism—it assumes the tool call has already been permitted or denied by an upstream policy engine. The output is a single, validated audit record object. Do not use this prompt for live blocking, anomaly detection, or as a substitute for cryptographic signing of logs. It is a documentation and compliance artifact, not a security control.

Before wiring this into production, ensure you have a reliable source of truth for each input field, especially the authorization decision and the actor's identity. If your agent operates in a multi-tenant environment, the session and user context must be strictly isolated to prevent cross-tenant audit contamination. The next step after generating the record is to append it to your append-only audit store and verify that the output schema passes validation before the record is considered complete. Avoid using this prompt for high-frequency, low-risk read operations where the audit volume would overwhelm storage without adding proportional compliance value.

This prompt template is designed to be integrated into your agent's post-tool-execution pipeline. It takes raw invocation data and produces a structured audit record suitable for compliance, security review, and debugging. The template uses square-bracket placeholders for all dynamic inputs, allowing you to inject runtime data from your agent harness without modifying the core instruction set. The output is a strict JSON schema that includes chain-of-custody fields, authorization decisions, and evidence of non-repudiation.

textCopy
SYSTEM: You are an audit trail generator for an AI agent system. Your only job is to produce a structured, non-repudiable audit record for a single tool invocation. You must follow the output schema exactly. Do not add commentary, summaries, or conversational text. If any required field cannot be determined from the provided context, set its value to null and set the `record_completeness` field to "INCOMPLETE".

INPUT DATA:
- Actor: [ACTOR_ID]
- Actor Role: [ACTOR_ROLE]
- Session ID: [SESSION_ID]
- Tool Name: [TOOL_NAME]
- Tool Operation: [TOOL_OPERATION]
- Target Resource: [TARGET_RESOURCE]
- Arguments (JSON): [TOOL_ARGUMENTS]
- Timestamp (ISO 8601): [TIMESTAMP]
- Result Summary: [RESULT_SUMMARY]
- Result Status Code: [RESULT_STATUS]
- Authorization Decision: [AUTHORIZATION_DECISION]
- Authorizing Policy: [AUTHORIZING_POLICY]
- Pre-execution Checklist Results (JSON): [CHECKLIST_RESULTS]

OUTPUT SCHEMA (JSON):
{
  "audit_record_id": "<uuid>",
  "record_completeness": "COMPLETE | INCOMPLETE",
  "chain_of_custody": {
    "actor": {
      "id": "<string>",
      "role": "<string>"
    },
    "session_id": "<string>",
    "timestamp": "<ISO 8601>",
    "record_generated_at": "<ISO 8601>"
  },
  "action": {
    "tool_name": "<string>",
    "operation": "<string>",
    "target_resource": "<string>",
    "arguments": {},
    "is_destructive": <boolean>
  },
  "authorization": {
    "decision": "GRANTED | DENIED | NOT_APPLICABLE",
    "policy": "<string>",
    "pre_flight_checks_passed": <boolean>,
    "human_approval_required": <boolean>,
    "human_approval_granted": <boolean | null>
  },
  "result": {
    "status_code": "<string>",
    "summary": "<string>",
    "error_code": "<string | null>"
  },
  "non_repudiation": {
    "evidence_type": "PROMPT_GENERATED_LOG",
    "input_hash": "<sha256 of serialized input data>",
    "prompt_version": "[PROMPT_VERSION]"
  },
  "compliance_flags": []
}

CONSTRAINTS:
- Generate a valid UUID for `audit_record_id`.
- Set `is_destructive` to true if the operation is DELETE, DROP, TRUNCATE, OVERWRITE, or any write operation that removes or replaces data.
- Compute `input_hash` by serializing all input fields to a canonical JSON string and hashing with SHA-256.
- If `human_approval_required` is true but `human_approval_granted` is null, set `record_completeness` to "INCOMPLETE".
- Add a compliance flag "DESTRUCTIVE_ACTION" if `is_destructive` is true.
- Add a compliance flag "HIGH_RISK" if `authorization.decision` is "GRANTED" and `is_destructive` is true.
- Add a compliance flag "INCOMPLETE_RECORD" if `record_completeness` is "INCOMPLETE".
- Do not invent or infer data. Use only the provided input fields.

To adapt this template, replace each [PLACEHOLDER] with runtime data from your agent's tool execution context. The [PROMPT_VERSION] placeholder should be a static string in your deployment configuration, allowing you to track which version of the audit prompt generated each record. For high-risk deployments, ensure the input_hash is computed and verified by your application layer, not solely by the model, to maintain a stronger chain of custody. The output JSON should be validated against the schema before being written to your immutable audit store. If the model returns record_completeness: "INCOMPLETE", log the raw invocation data separately and trigger an alert for manual review.

The audit trail prompt is not a standalone utility—it must be embedded into a tool execution harness that intercepts every tool call, captures pre- and post-invocation state, and persists structured records before the agent continues. Wire this prompt as a synchronous interceptor in your agent framework's tool-calling middleware. When the agent selects a tool and prepares arguments, the harness pauses execution, invokes the audit prompt with the full invocation context, validates the output against the expected audit record schema, and only then allows the tool call to proceed. The audit record must be durably written to an append-only log or compliance database before the tool's side effects occur, ensuring no gap between action and evidence.

Implement the harness with a pre-invocation hook that captures actor, action, target, arguments, authorization_decision, and timestamp before the tool runs, and a post-invocation hook that appends result_summary, status_code, duration_ms, and any error details. Use a strict JSON Schema validator on the prompt's output—reject and retry any record missing required fields like audit_id, chain_of_custody, or non_repudiation_evidence. For high-compliance environments, generate a cryptographic hash of the full audit record and include it in the non_repudiation_evidence field. Log every validation failure and retry attempt to a separate operational log so compliance reviewers can distinguish between tool failures and audit-generation failures.

Model choice matters: use a deterministic, low-temperature model (temperature 0.0–0.1) with structured output enforcement. Avoid models that paraphrase or summarize tool arguments—the audit record must preserve exact argument values, not approximations. If the prompt fails validation after two retries, the harness must block the tool invocation and escalate to a human operator with the partial audit context. Never allow a tool to execute without a valid audit record. Wire the harness to emit OpenTelemetry spans for each audit generation step, and ensure the audit log storage is immutable and queryable by audit_id, session_id, and timestamp for downstream compliance review tooling.