Here is the tension nobody flags when they wire an AI coding agent into production: the agent is both the actor and the historian. It runs the commands, and it writes the log of what it ran. An audit trail that the audited party authors is not an audit trail. That single conflict is what AI coding agents really do to your audit trail.
For a human engineer, the separation is implicit. The engineer runs a query; the database, the bastion, the IdP each log it from their own vantage. The engineer cannot quietly edit all of them. An agent collapses that separation, because the convenient place to capture its activity is the agent's own runtime, the one thing the agent fully controls.
Why the agent's own logs do not count
An audit trail has one job: let someone reconstruct what happened, with confidence the record was not altered by the actor it describes. Three properties make it work, and an agent breaks all three:
- Independence. The record must come from somewhere the actor does not control. Agent-internal logs fail this by definition.
- Attribution. Each action ties to a specific identity. Agents commonly run under one shared credential, so actions attribute to "the agent," not a session or purpose.
- Completeness. Every action against the system is captured. An agent can take a path its own logging does not cover.
You can bolt more logging onto the agent, but you cannot fix independence that way. The actor is still the historian.
Move the historian off the actor
The fix is structural, not additive. The audit trail has to be produced by something the agent crosses to reach infrastructure, not by the agent. That boundary sees every query and command on the way through, binds it to an authenticated identity, and writes the record where the agent cannot touch it.
This is what an identity-aware access gateway provides. Route the agent's database and infrastructure connections through hoop.dev, and the command-level audit trail accumulates at the gateway, outside the agent process, tied to a named identity per session. One precision worth stating: hoop.dev records the infrastructure actions the agent takes, the queries and commands. It does not read the model's prompt or output. The audit trail is of what the agent did to your systems, which is the part an auditor or incident responder actually needs.
What the trail looks like in practice
An agent connects through the gateway as agent-backfill, runs a sequence of UPDATE statements against a production table, and disconnects. The gateway's record shows the identity, the time-bounded grant, and every statement verbatim, in order. If something went wrong, you replay that session without asking the agent what it thinks it did. The contrast with the agent's self-report is the whole point. One records what happened at the boundary. The other is the actor's account of itself.
The same record does more than satisfy an auditor. When an incident lands and you need to know whether an agent touched a given table in the last hour, you query the gateway's trail, not a dozen scattered runtime logs. When a compliance program asks for proof that agent access was authorized and bounded, the per-session record already holds it. The audit trail stops being a thing you reconstruct after the fact and becomes a thing that exists by default, because the boundary wrote it as the work happened. That is the difference between hoping the agent logged enough and knowing the gateway did.
FAQ
Can I just turn on verbose logging in the agent?
That improves detail but not trust. The log still lives inside the actor, so it fails the independence test an audit trail depends on. Capture the trail at the boundary instead.
Does the gateway log the agent's prompts?
No. It records the queries and commands the agent runs against infrastructure, not the model's input or output. The audit trail is of actions on your systems.
How does this handle multiple agents?
Each session authenticates as its own identity, so the trail attributes actions per agent and per session rather than to one shared account.
An audit trail is only as good as its independence from the actor. See how the gateway captures each session on the hoop.dev getting started guide, and read the recording code at github.com/hoophq/hoop.
