A compliance audit requires a complete record of which agent performed which action, in what order, and what the inputs and outputs were for a multi-agent deployment pipeline. What design practice enables this audit trail?
Select an answer to reveal the explanation.
Short Explanation
Structured, structured, structured — you need every agent step to emit structured event logs automatically: agent ID, action, inputs, outputs, timestamps. Don't rely on memory or commit history; aggregate those logs in a centralized audit store so you get a complete, queryable record.
Full Explanation
Compliance audit trails for multi-agent pipelines require structured, automated, per-step event emission — not manual documentation or inference from git history.
Audit trail event schema: { "event_id": "uuid", "agent_id": "gh-copilot-deploy-agent-v2", "action": "create_pull_request", "timestamp": "2025-10-01T14:32:11Z", "inputs": {"branch": "feature/auth-fix", "base": "main"}, "outputs": {"pr_number": 142, "url": "..."}, "status": "success", "pipeline_run_id": "run-9823" }
The correct design practice is to instrument each agent step to emit structured event logs with agent ID, action type, inputs, outputs, and timestamps, then aggregate these in a centralized audit log store. Structured event logging emitted automatically at each step provides the complete, immutable, machine-readable record compliance requires. Centralizing in a log store (e.g., GitHub Audit Log, SIEM, S3) enables querying and reporting.
Requiring developers to manually document agent actions after each pipeline run is wrong because manual documentation after the fact is unreliable, incomplete, and does not scale. Developers may misremember or omit steps, and there is no guarantee of completeness.
Using GitHub Actions' built-in logs, which automatically capture all agent actions, is wrong because GitHub Actions' built-in logs capture stdout/stderr but are not structured event logs. They do not automatically record agent ID, semantic action types, structured inputs/outputs, or the relationships between steps in the format compliance requires.
Running audits quarterly by reviewing git commit history for evidence of agent activity is wrong because git commit history shows what was committed, not what every agent action was. Many agent actions (API calls, file reads, decisions) leave no git trace. Quarterly reviews are also too infrequent for continuous compliance.