AgentBrain SOP

Appearance

Immutable Audit Logs ​

Every data access, agent action, and permission change is logged and tamper-proof. Full compliance trail on demand. Integrates with OpenTelemetry for distributed tracing across agent pipelines.

Capabilities ​

  • Tamper-evident log storage
  • Export to SIEM (Splunk, Datadog)
  • Configurable retention: 30 days to unlimited

Sample Audit Log ​

2026-04-23T09:12:01Z  alice@corp.com    agent.invoke      hr-assistant
2026-04-23T09:12:04Z  hr-assistant      knowledge.read    policy-v3.pdf
2026-04-23T09:13:11Z  admin@corp.com    role.grant        dept:engineering

Every line includes:

  • Timestamp (UTC, ISO 8601)
  • Actor (user, agent, or service identity)
  • Action (agent.invoke, knowledge.read, role.grant, etc.)
  • Resource (the target of the action)

What Gets Logged ​

  • Authentication: login, MFA challenge, SSO assertion verified
  • Authorization: role grant, role revoke, permission override
  • Agent activity: invocation, tool call, knowledge retrieval, handoff
  • Knowledge access: doc read, doc upload, source connect
  • Configuration changes: agent edits, workflow edits, RBAC edits

Tamper-Evidence ​

Audit log entries are append-only and cryptographically chained. Any attempt to modify or remove a past entry breaks the chain and is detectable on verification.

SIEM Export ​

AgentBrain streams audit events to your existing SIEM:

  • Splunk (HTTP Event Collector)
  • Datadog Logs
  • Generic syslog
  • OpenTelemetry exporter for tracing systems (Jaeger, Tempo, Honeycomb)

Retention ​

Default retention is 30 days. Business tier supports configurable retention; Enterprise and Custom tiers support unlimited retention with archival to cold storage.

  • RBAC for permission change events
  • Compliance for retention requirements