Field Notes

Auditability: what to capture (and how to keep it sane)

Audit trails don’t mean storing everything. They mean storing the right evidence so you can explain decisions later—without creating new risk.

• Thinking Code AI•Auditability • Security • Compliance
← All posts
Post cover

Auditability ≠ surveillance

Teams often overcorrect by logging everything.

That creates:

  • security risk
  • storage cost
  • accidental exposure

Capture evidence, not noise

A practical audit record often includes:

  • case ID + workflow step
  • input document metadata (hash, type, source)
  • extracted structured fields
  • citations back to source spans
  • policy checks (pass/fail + rule version)
  • reviewer decisions and overrides

Make audits easy

Two ideas that save teams:

  1. Version your policies like code.
  2. Use structured outputs so downstream systems can validate without reading prose.

If you want one rule

If you can’t answer “why did this happen?” in 2 minutes, your audit trail isn’t doing its job.