What should an audit log capture for agent tool calls?

An audit log for agent tool calls should capture the agent identity, workflow or session ID, user or initiating context when relevant, tool name, operation, timestamp, policy decision, input/output metadata, success or failure result, and any downstream handoff. The goal is to make the execution explainable without exposing unnecessary sensitive content. For regulated or security-sensitive teams, the log should help answer what happened, why it was allowed, and what systems were touched. Diagrid emphasizes audit-friendly tracing and Verifiable Execution so teams can connect agent actions to identity and workflow context.