A sales representative asks an AI Agent to prepare a quotation, but the figures are incorrect. A procurement specialist asks an AI Agent to compare supplier terms, only to find that it cited data it should not have used. If the company retains only the user’s original input and the final answer, it can see only the beginning and end of the process after an incident. It may be impossible to determine which tools were called, what data was retrieved, or the order in which each action occurred.
According to an iThome report, Cisco’s open-source AI Agent behavior detection tool, Project Quarry, analyzes tool calls, tool execution results, and the sequence of operations to help security teams identify suspicious behavior. The report also warns that retaining only the input and final answer may not provide enough information to reconstruct the entire process. Before deploying an AI Agent, enterprises must therefore answer one critical question: Do the records currently being retained allow IT, security, and audit teams to review the entire workflow?
Audit Records Must Answer at Least Three Questions
The first question is what actions the AI Agent performed. In addition to the user’s instructions and the final output, enterprises should retain tool calls and tool responses. Otherwise, when something goes wrong, it will be difficult to determine whether the model made an incorrect judgment, failed to retrieve the correct data, or encountered a failure while executing a downstream tool. For example, if a supplier is missing from a procurement comparison table, the finished document alone cannot reveal whether the supplier was omitted during the search, the data could not be retrieved because of a connection issue, or a row was accidentally deleted while the data was being organized.
The second question is the sequence in which the actions occurred. An AI Agent performs multiple steps in succession, and even when the same tools and data are used, a different sequence may produce a different result. Every task should therefore include timestamps and step-by-step records, enabling investigators to trace the process from the beginning to the exact point of failure instead of trying to infer the sequence from a handful of disconnected records.
The third question is who accessed or exported the records. Audit data may contain details about internal company operations. In addition to investigating what an AI Agent did, enterprises must therefore know who accessed these records. IT, security, and audit teams can jointly define what records should be retained, how they may be accessed, the procedures for exporting them, and how often they should be reviewed. They can then conduct a test using an actual task to confirm that all three questions can be answered: What was done, in what order, and who accessed the records?
EgentWrX audit logs cover 55 resource types and can be exported through the Export Center. A hash chain is used to verify whether any records in the sequence have been altered. The system also creates a record whenever an administrator downloads audit logs. Although the platform provides mechanisms for viewing, exporting, and verifying records, enterprises must still decide which teams are responsible for reviewing them, how often reviews should take place, and who will handle any anomalies that are discovered.
Even With Complete Records, Enterprises Must Restrict Which Data an AI Agent Can Access
Complete records support post-incident investigations, but they cannot replace preventive access controls. Quarry can check whether tool responses contain prompt injection instructions—commands embedded in external content that attempt to alter an AI Agent’s behavior. It can also detect whether an AI Agent has deviated from its assigned task. Enterprises, however, should not wait for a detection tool to issue an alert before addressing unnecessary connection and write permissions.
Project teams can begin by creating a connection list for each task. The list should identify the internal databases the AI Agent must read, the external services it must use, and whether each connection requires read or write access. If a sales representative only needs to query historical orders while preparing a quotation, the project team should grant read-only access rather than also allowing orders to be modified. If an AI Agent does not need public websites to perform quality-control work, the team does not need to enable external connections.
Managers can ask the project team directly: Is this data source truly essential? Does the AI Agent only need to read the data, or does it genuinely need write access? Is this external domain directly related to the task? If the team cannot provide a clear explanation, access should not be granted until the responsible unit clarifies its purpose. Existing connections should also be reviewed regularly to confirm that they are still required for business operations.
When an Anomaly Is Detected, the Process Must Stop Immediately
Cisco’s documentation states that enterprises can use existing AI Agent execution records to test and refine detection rules, reducing the likelihood that normal activities will be misclassified. They can also incorporate security checks while an AI Agent is performing its work. In other words, enterprises should not configure detection rules only once before launch and leave them unchanged. They must continually test the rules against actual records to distinguish normal operations from situations that require human intervention.
If the system merely sends an alert while the AI Agent continues transmitting data externally or proceeds to the next step, security personnel may not see the records in time to prevent the action. Enterprises can first identify steps involving financial amounts, external transmission, ambiguous conditions, or transfers of responsibility, then specify an approver, approval criteria, and a process for returning or rejecting each one. Lower-risk data-processing tasks may continue automatically. When a high-risk step is reached, however, the workflow should pause until an authorized person reviews and approves it.
EgentWrX integrations with internal company databases are read-only and cannot write data. All external connections are denied by default, with domains enabled individually according to the requirements of each task. Workflows can also require human approval before a handoff, allowing the AI Agent to complete the preceding work and then pause until approval is granted. Enterprises can begin by testing one real-world process and checking whether the records clearly explain why an alert was issued, who approved the action, and what happened after approval. If any part of the process cannot be traced, the company should improve its records or approval procedures before expanding the scope of use.
FAQ
Can an AI Agent be audited if only the prompt and final answer are retained?
Not comprehensively. The prompt and final answer show only the starting and ending points of the task. Without records of tool calls, tool responses, and the sequence of operations, investigators will struggle to identify which step failed or determine whether the AI Agent deviated from its assigned task.
What information should AI Agent activity records contain at a minimum?
At a minimum, enterprises should retain the user input, final answer, tool calls, tool responses, sequence of operations, and details of who accessed or exported the records. They should also create identifiers that link every step of the same task and test the records using actual tasks to confirm that investigators can reconstruct the entire process from beginning to end.
Are connection restrictions still necessary when complete audit records are available?
Yes. Records support post-incident investigations, while connection restrictions proactively limit the data an AI Agent can access and modify. Internal databases can initially be configured as read-only, while external domains can be denied by default and enabled individually according to the actual requirements of each task.
Should an AI Agent stop immediately when suspicious behavior is detected?
It should pause and wait for human review when it reaches a high-risk step. Enterprises can identify conditions such as financial amounts exceeding defined limits, external transmission, ambiguous requirements, and transfers of responsibility, then specify the approver, approval criteria, and process for returning or rejecting the action. Whether lower-risk steps may continue should be determined according to the company’s internal policies.
References
- Cisco open-sources Quarry, an AI Agent detection tool that analyzes multi-step operations to identify suspicious behavior — An iThome report on the activity-record requirements and detection methods of Cisco Project Quarry.
