After deploying a Copilot agent that automatically closes resolved issues and merges approved PRs, your compliance team reports that the organization's audit log shows actions attributed only to the GitHub App service account, with no indication of which agent run, which user request, or which model decision triggered each action. What is the most important improvement to implement?

GitHub's organization audit log captures API calls at the platform level—who (which App installation) did what action on which resource—but it has no visibility into the agent's internal decision-making process: what prompt triggered the run, which user initiated it, what the model's reasoning was, or which specific condition in the agent logic led to the action. This is the traceability gap the compliance team is identifying.

The correct solution is to emit structured audit events from the agent itself, written before each side-effecting action. These events should include: the run ID (so you can correlate all actions from a single execution), the triggering event (e.g., 'user X manually triggered' or 'webhook event Y'), a summary of the model's decision rationale, the specific action about to be taken, and a timestamp. These events should go to an append-only store (e.g., a dedicated audit log table, a SIEM, or an immutable blob storage location).

Option A (bot user account) changes the display name but provides no additional traceability about why actions were taken. Option C (audit log streaming) improves platform-level visibility but still captures only the external action, not the agent's internal reasoning. Option D (comments on issues/PRs) is a partial measure—it documents the reason but in a mutable, non-structured format that can be deleted and is hard to query for compliance purposes. Pre-action, structured, append-only audit events are the Responsible AI accountability standard.