You don't actually have an audit trail for your agent

Three pieces this week, from very different corners, point at the same uncomfortable conclusion: the audit trails most teams think they have for their coding agents are not the audit trails they actually need.

The first is operational. An OpenAI Codex issue walked through the math on a logging bug. After 21 days of uptime, the user’s SSD had absorbed roughly 37 TB of Codex log writes, extrapolating to about 640 TB per year. On a 1 TB SSD, that’s about 640 full-drive writes per year, which is the entire warranted endurance of many consumer SSDs in less than 12 months. About 96% of the retained log bytes are TRACE-level firehose: inotify events, OpenTelemetry mirror writes, raw websocket frames. The logs are technically there. They are not usable as an audit trail and they are actively damaging the disk they’re written to.

The second is forensic. Patrick McCanna sat down to read Claude Code’s “extended thinking” output and discovered something most users have not noticed. What the SDK returns as the model’s reasoning is, per Anthropic’s own docs, a summary of the real reasoning. The actual chain of thought is encrypted, with the key held by Anthropic. Getting the unsummarized version requires an enterprise agreement. “I have the agent’s thinking on my disk” turns out to mean “I have a summary of the thinking on my disk.” Those are very different artifacts when a regulator or an incident response team asks what really happened.

The third is grassroots. A Show HN today shipped “Ponytrail,” a local audit trail for AI coding-agent edits. The project’s existence is the signal. Developers are inventing their own audit infrastructure because the platforms’ built-in answers are not enough.

Three reads worth taking seriously for anyone running or selling agent systems in 2026.

• Logs are not audit trails. Volume is not provenance. An audit trail tells you which agent took which action, on whose behalf, against what context, with what reasoning, at what point in time, and lets you reproduce the chain on demand. Most of what current platforms ship as “agent logs” fails at least one of those tests. Inventory yours against that checklist before you write the next compliance section of a customer deck.
• Provider-side reasoning visibility is conditional. If your agent’s “explainability” story depends on the model provider returning the reasoning trace, ask explicitly whether the trace is real, summarized, encrypted, or held in escrow. The answers vary by vendor, by tier, and by SKU. Customers will read the fine print eventually. Better to read it first.
• For Microsoft Foundry partners, this is where the observability and evaluation push from Build earns its keep. OpenTelemetry-grade traces, scoped to the agent’s actual actions and tool calls, written to durable storage the customer controls, with sampling that doesn’t burn down their SSD. The partners who package a serious agent observability story (including a documented retention model, sampling strategy, and replay capability) will out-procure the ones still treating “logs” and “audit trail” as the same noun.

The uncomfortable summary: we shipped agents into production faster than we shipped the operational primitives to govern them. Catching up is going to take real engineering, not a settings page. The teams that take this week’s three pieces seriously will be ready a year before the teams that don’t.