AI Agent Evidence: Tool Calls, Identities and Downstream Logs

Start with stable identifiers

Correlate run, session, workflow and deployment identifiers with timestamps and timezones. Preserve the configuration that existed at the time. An agent’s current setup can differ materially from the version involved in the incident.

Follow the identity

Determine the principal used for each tool action and the permissions it held. User delegation, service accounts and application credentials create different boundaries. Review approval records alongside access records rather than assuming the initiating user performed every action.

Reconcile attempts with effects

Tool arguments and responses are useful, but destination records establish whether the operation took effect. Check retries, asynchronous jobs, partial failures and queued work. A stopped run does not necessarily cancel an external job it already created.

State the reconstruction limits

Missing traces, retention gaps and non-deterministic behaviour may prevent a complete account. Preserve the evidence that exists and identify unsupported conclusions. A response report should distinguish confirmed events, hypotheses and unanswered questions.

A correlation record for asynchronous work

Reference	Why retain it
Parent run and child task	Connect the request with delegated work
Service principal and approval	Identify authority, not just a display name
Tool request and job identifier	Follow an operation that completed later
Destination record version	Establish the resulting state
Clock and time zone	Reconcile ordering across systems

Use our AI digital forensics to turn these questions into an agreed scope.

Prepare the next step

Explore AI incident response from Atlant Security, use the evidence checklist or prepare a non-sensitive incident brief for the team.

Sources and further reading

Reviewed 23 October 2026. These sources inform the approach; they do not certify or endorse Atlant Security.