Almost every AI platform I have seen in production logs the prompt and the response. Almost none logs the tool call with its arguments. And the tool call is what produces an effect in the world — the prompt is only stated intent.
Why prompt logs are useless for investigation
In an incident the questions are always the same: what was accessed, by which identity, when, and what left the environment. Prompt logs answer none of them. Worse: in indirect injection the user's prompt is innocent — the hostile instruction arrived from a repository issue or a page read along the way.
The Invariant Labs case illustrates it well: a malicious issue in a public repository was enough to redirect an agent with GitHub access into reading private repositories and publishing their contents. The user did nothing unusual — they asked for a review of open issues. A prompt log of that incident shows absolutely nothing wrong.
If your only record is what the user typed, you do not have an audit trail. You have chat history.
The minimum event
A useful tool-call event carries seven fields:
- Agent identity — individual, not the fleet's shared service account.
- Delegating human identity, where one exists.
- Server and tool name.
- Arguments, with sensitive fields masked but the destination always visible — URL, path, table.
- Outcome: success, denial, error. A denial is worth as much as a success.
- Task correlation ID, so the sequence of actions can be reconstructed.
- Provenance of the content that entered the context before the call, where traceable.
That last field is the hardest and the most valuable: it is what connects “read this external page” to “called this write tool thirty seconds later”.
Where the event belongs
In the same SIEM that receives everything else. Not in the AI vendor's dashboard, not in a local file on the agent host. The reason is practical: correlation. The real value shows up when you join tool calls against network flow logs, IAM events and egress proxy logs.
What this lets you detect
- A tool called outside that agent's historical hours or frequency.
- An external-read to external-write sequence inside the same task.
- An argument pointing at private or link-local ranges — an SSRF attempt visible in the log, not only in the outcome.
- Anomalous call volume, usually the first evidence of an agent stuck in an uncontrolled loop.
None of these detections requires a new tool. They require the event to exist.
