A Record of Every Action, with a Way to Undo It

TL;DR Keep a record of every action your agents take for the organization (when, who, what, where, who approved it, and how to undo it), never of what people say to them, and make every change you can undoable in one step.

The problem

When something an agent did goes wrong, nobody can say exactly what it did, who approved it, or how to put it back.

Also called: Log Actions, Not Conversations, Everything Reversible

How it works

The pattern draws a line between actions and conversations. An action is anything an agent does that reaches beyond the conversation, such as a change to shared knowledge, a message sent, a page published, or a file filed. In Building Agentic Organizations, chapter 16, the rule is put plainly: "Actions are the organization's business. They change shared things, and the organization needs to be able to answer for them. Conversations are the person's business." Chapter 11 sums up the reason in three words, "help, not watch": "The organization has every reason to want to know what its agents did; it has no reason to know what its people said."

Each action gets one record that answers six questions: when it happened, which person's agent or which service acted, what kind of action it was, what it changed, who approved it, and how to undo it. What stays out matters just as much. The record holds no prompts, no drafts, no reasoning, nothing from the person's private memory, and no message text beyond what was actually sent. A change to a document is recorded only by its identifier and location. The change itself stays in the document's own history, where only people allowed to see that document can read it.

Building Agentic Organizations, chapter 18, adds the other half: "If failures will happen, every change should be easy to undo." Knowledge changes are reverted in one step, an agent rolls back to its last good version, a website restores its previous deployment, and settings on outside services are backed up before an agent changes them. Some actions cannot be recalled, such as an email sent, a message posted, or a payment made. Of these the chapter says: "For these, the defense comes before the action": a person sees the exact text, or approves the step, first.

Nobody has to look inside a conversation, because agents change shared things only through a few doors: one service for knowledge, the organization's channels for messages and posts, and a publisher for websites. Each door writes its own record. The organization can then gather these into one log and add a test that fails if anyone adds a field beyond the six, so a system holds the privacy line, not good intentions. Auditors read the action records. If they need more, they ask the person, who decides what to share.

An example

From this publication's own records: every post our agents send to LinkedIn and X is recorded with when it went out and its address on the platform. Posts the editor in chief deleted before launch keep their records, marked deleted, so the record still shows they existed. After launch our published pages are not deleted: a withdrawn article keeps its address with a notice, and the notice gives the reason recorded when it was withdrawn, unless privacy or the law requires saying only that the text was removed.

Trade-offs

When a problem starts in the conversation itself, the action log won't show it, and the only way to learn more is to ask the person, who may say no. For one person working with their own agents, where the user and the builder are the same person, reading the conversation is often the fastest way to understand a failure, and Building AI Agents records conversations in that setting. Making every change undoable takes work up front: backups before changes, versions kept, and a tested way back for each kind of change.

What would change our mind

If the action records are never read, they are only storage; we would change what is recorded to what audits and incident reviews actually ask for.

How others describe it

OWASP Foundation: “The application logs must record "when, where, who and what" for each event.” Logging - OWASP Cheat Sheet Series
Wikipedia: “An audit trail (also called audit log) is a security-relevant chronological record, set of records, and/or destination and source of records that provide documentary evidence of the sequence of activities that have affected at any time a specific operation, procedure, event, or device.” Audit trail

Where we use it

GSSF records what its agents do, not what people say to them; one log bringing every record together is planned (Building Agentic Organizations, chapters 11 and 16). This publication keeps a record of every post its agents send and every article it withdraws.

Status: Running for recording actions; Planned for one log · Origin: Established practice, adapted for agents

Sources

See something wrong? Report an error.