GOV-13: Per-action audit log tied to a person
In short: Log every agent action with the agent, the person it acted for, the tool, the decision and the time. An audit log that names only a service account cannot answer the question auditors ask most: which person is accountable for this action?
1GOV-13
What does GOV-13 require?
Log every agent action with the agent, the person it acted for, the tool, the decision and the time.
Why does it matter?
An audit log that names only a service account cannot answer the question auditors ask most: which person is accountable for this action?
How do you test it?
- Pick a recent agent action and find its log entry.
- Confirm the entry names the person the agent acted for.
- Check denied and approved actions are logged as well as allowed ones.
Which platforms document GOV-13?
Documented by NewCore, Silverfort and Cyera Identity.
- 9.10NewCore documentedSource: NewCore: Secure; NewCore: Govern, read
- 8.35Silverfort documentedSource: Silverfort: AI Agent Security, read
- 7.30Cyera Identity documentedSource: Oasis Agentic Access Management, read
- 7.30Astrix Security partly documentedSource: Astrix product, read
- 6.55Aembit partly documentedSource: Aembit IAM for Agentic AI is generally available, read
- 6.55Token Security partly documentedSource: Token Security home, read
- 6.55SailPoint Entro partly documentedSource: SailPoint agentic AI security, read
- 5.50Idira partly documentedSource: CyberArk Secure AI architecture docs, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
Which framework references apply?
- EU AI ActArticle 12: Record-keeping: high-risk systems must allow events to be recorded automatically as logs. Source: Regulation (EU) 2024/1689, the AI Act, on EUR-Lex
Which controls are related?
- GOV-14SIEM export
- GOV-23Evidence retention
- GOV-07Human approval for high-risk actions
Glossary: audit trail, chain of custody, on-behalf-of, mcp gateway.
Reviewed by The Register desk