Incident owners
You need a redacted chronology of supported evidence that can inform the next internal, legal, HR, or cybersecurity decision.
Evidence-led agent review
AI agent activity audits and session reconstruction.
Review supported agent records to understand what happened in selected sessions: which commands ran, which files and tools were involved, where network activity pointed, what a person approved, and where the evidence stops.
Records
Timeline
Access
Confidence
Who It Is For
For a specific question about agent behavior—not a generic security score.
Useful for Maine organizations investigating an unusual session, reviewing a sensitive workflow, preparing an internal incident record, or checking whether actual agent activity matched approved boundaries.
IT and system owners
You need to connect an agent identity or session to tools, files, commands, destinations, errors, and approvals.
Governance leaders
You need to compare observed activity with policy, least-privilege expectations, and named human-control points.
Questions Addressed
Turn fragmented agent records into a reviewable account.
What was the sequence?
Order supported prompts, tool calls, command activity, approvals, failures, and outcomes without reproducing unnecessary private content.
What did the agent reach?
Identify supported evidence of files, tools, applications, commands, endpoints, and agent-to-agent delegation.
Who was in control?
Mark visible human decisions, missing approvals, inherited user authority, and ambiguity about the acting identity.
Did access exceed scope?
Compare observed actions against the use case, assigned tools, permission boundary, and expected destinations.
What cannot be known?
Document deleted, unsupported, hosted, encrypted, expired, or otherwise unavailable evidence and its impact on confidence.
What should change?
Translate evidence into concrete recommendations for access, approval, retention, logging, ownership, and escalation.
AI Agent Activity Audit
- Evidence-source and coverage register
- Review of supported agent records for the agreed window
- Reconstruction of selected sessions or activity chains
- Redacted timeline of relevant commands, files, tools, destinations, and approvals
- Access and permission observations tied to available evidence
- Finding register with severity, rationale, and recommended follow-up
- Explicit limitations and confidence level for each conclusion
Method
How the audit works.
Frame the question
Define the relevant agent, time window, business concern, authorized reviewers, sensitive-data rules, and decisions the timeline must support.
Preserve and inventory
Identify available supported records and document source, scope, access, retention, and gaps. Originals remain controlled by the client unless separately agreed.
Reconstruct and corroborate
Order relevant events and compare records across available agent, tool, approval, and system surfaces without treating a single signal as conclusive.
Redact and brief
Remove unnecessary prompts, credentials, personal data, and client content; then present conclusions, confidence, limitations, and next actions.
Human Control
Auditability depends on deliberate approvals and scoped identities.
Future recommendations favor unique owners, narrow credentials, visible approval events, durable but proportionate records, and a clear shutdown path. Least privilege limits the possible action set; human approval makes consequential exceptions explicit.
Common Questions
Activity audit FAQ
Can every agent session be reconstructed?
No. Coverage depends on supported agents, available local or platform records, retention, permissions, record integrity, and whether actions happened through observable tools. The audit documents gaps and confidence rather than filling them with assumptions.
Is an AI agent activity audit the same as your organization-wide AI audit?
No. The AI agent activity audit focuses narrowly on agent behavior, tools, files, commands, permissions, records, and selected sessions. The organization-wide AI audit covers broader policy, adoption, workforce, vendor, and governance questions.
Will you publish our findings?
No. Evidence and reports are handled within the agreed engagement scope. Public use, a case study, or disclosure requires separate written human approval and appropriate redaction.
Start with the event, session, or control question you need answered.
Do not send private records through the public form. Describe the situation at a high level; secure evidence handling can be agreed after scope and confidentiality terms.