Audit an agent action: evidence worksheet for external tool calls

Examining an external action

When an AI agent takes an action in an external system, such as dispatching an email, internal model traces alone do not show what took place. An agent context can record that a message went out even if the network dropped the request, an intermediary modified the text, or parameters targeted the wrong recipient.

Auditing an external action requires matching observable records across the action path. This guide provides a concise procedure and evidence worksheet for reviewing whether available records substantiate a specific claim about an outbound action. These elements are illustrative rather than universally sufficient, because different environments expose different logging boundaries.

Core evidence elements

A structured review compares the claimed action against observable records and known verification limits.

Evidence element	What to inspect	Audit risk or limit
Claim and scope	Specific assertion naming the agent, recipient, message topic, and time window	Broad or ambiguous claims cannot be tested against evidence
Action request	Outbound dispatch parameters recorded in gateway or sender logs	Internal logs do not prove the external network accepted the call
Specific approval	Documented policy rule or user consent matching recipient, content, and time	Broad credential scope or API key access does not equal user authorization
Service acceptance	Acknowledgment code and transaction reference from the receiving mail service	Acceptance at the service boundary does not prove mailbox delivery or recipient reading
Trace continuity	Timestamp correspondence and matching references across sender and service logs	Missing links may make a finding inconclusive; contradictory records may refute the claim

Hypothetical case: reviewing an outbound email

Hypothetical scenario: This example illustrates how to record a finding. It is not a report of an observed system or benchmark result.

A reviewer investigates a claim that an automated support agent sent a single account notification email to a customer during an afternoon maintenance window.

The reviewer examines four records described in operational documentation:

Action request: Outbound gateway records show an email dispatch request matching the specified customer address, the stated account notification subject, and the requested timestamp.
Specific approval: A recorded approval predates dispatch and covers the recipient and message content in the outbound request. The reviewer checks that the approval was valid at execution time. An active mail service credential alone would not establish authorization.
Service acceptance receipt: The external mail provider returned an acknowledgment indicating that the message was accepted into its delivery queue.
Trace continuity: A shared transaction reference connects the outbound request to the service receipt. The reviewer compares the approved recipient and content with the submitted payload. Similar timestamps or matching subjects alone would not establish that the records describe the same action.

Bounded finding: The records support the claim that the agent requested the message, that valid approval applied to this exact action, and that the external provider accepted the payload for transmission.

Limits of the finding: These records do not prove inbox delivery, reading, or the absence of downstream forwarding. Missing records may make a finding inconclusive. A recorded action that contradicts the approved scope may instead refute the claim. Record which conclusion the evidence supports.

Plaintext worksheet template

Copy the compact template below into review notes to evaluate external agent actions.

AUDIT EVIDENCE WORKSHEET: AGENT EXTERNAL ACTION

1. CLAIM
   Agent name:
   Claimed action:
   Target recipient:
   Claimed time window:
   Agent/tool version and configuration reference:

2. OBSERVABLE ACTION REQUEST
   Sender or gateway log reference:
   Requested recipient:
   Requested subject or action summary:
   Request timestamp:

3. APPROVAL AND AUTHORIZATION
   Policy or consent reference:
   Exact authorized scope (recipient, content, time):
   Redacted credential identifier:
   Authorization notes (credential scope alone is insufficient):

4. EXTERNAL SERVICE ACCEPTANCE
   External service name:
   Service acknowledgment reference:
   Acceptance timestamp:
   Note: Confirms service queue entry, not mailbox delivery or reading.

5. REVIEW DETERMINATION AND BOUNDARIES
   Finding: [Supported / Inconclusive / Refuted]
   Evidence summary:
   Unobserved downstream states:
   Gaps, missing logs, or payload discrepancies:
   Reviewer and date:

Privacy and redaction

Collect only the evidence needed for the claim. Use redacted references in shared review notes, keep necessary sensitive records under access controls, and set a retention period. Do not copy passwords or API keys into the worksheet.