Flight recorder
also called agent flight recorder · black box recorder · agent trace record
The metaphor is borrowed precisely, and it commits you to three things. An aircraft recorder is a separate device from the systems it records, it writes as events happen rather than reconstructing them afterwards, and it is built to survive the aircraft. The equivalents are: written by the enforcement point rather than by the agent or its framework, appended at each step of the request rather than summarised at the end, and kept where the recorded party cannot quietly amend it. Most agent tracing satisfies the second only. A trace tree emitted by the same framework that made the call is a description of what happened written by the thing that did it, which is useful for debugging and is not evidence against the process.
What has to be recorded, and when, follows from that. The record must open before the verdict, which means minting its identifier early in the request path — before sanitisation, before scanning, before the policy decision — so a request refused a millisecond later is present rather than missing. Every stage then appends to the same record: the decision and its reason, the tool call and its arguments, the human approval with approver identity, timestamp and rationale, the tokens and the cost. The identifier should come back on every response including refusals, so a caller can quote a request that never reached a provider. And a failed or interrupted run has to be recorded as failed, with its partial usage still metered: a failed run recorded as a success is worse than no record, because it is a record that lies.
What must not be recorded matters as much, because the recorder is a liability as well as an asset. It is not a transcript. Keep the prompt as a bounded post-redaction excerpt read off the outbound payload rather than the original, so the search index cannot hold what the redactor just removed; do not store the model’s answer text at all, recording instead the stop reason, the token counts, the number of redaction placeholders and the types of content blocks; record redaction events as kinds and counts, never values. The reason is that this store is a corpus of people’s activity that the organisation did not have before it deployed agents, and everything it keeps it must then be able to scope, retain, export and erase. Bounding tool arguments and results serves the same end: the record is evidence of an action, not a conversation.
A recorder nobody can question is not evidence. The question a compliance officer actually arrives with — did any agent move more than five hundred pounds without a human looking at it, last quarter — has to be answerable without a join across four systems and somebody who can write SQL, because evidence that is present and unusable is, in an audit, the same as evidence that is absent. The obvious fix is the dangerous one: pointing a language model at the trace database and letting it write the query builds an interpreter input generated from untrusted text, and trace content is attacker-influenced by construction, since tool results are authored by whoever the agent fetched them from. The safer shape is to let the model emit only a filter object over an allow-listed field set, validated before it reaches a parameterised query builder. The price is expressiveness — no grouping, no aggregation, no correlation across records — and misinterpretation replaces injection as the failure mode, which is why the interpreted filter should be shown back beside the results rather than applied silently.
Two operational decisions finish the picture. Keep the recorder in a different table from the tamper-evident chain of administrative acts, with no foreign key between them, so a retention pass or a subject erasure can remove traces while chain verification still passes and the record that a deletion happened outlives the deleted data. And decide retention explicitly: an unset window normally means keep forever, which over-satisfies a minimum-retention duty and fails a storage-limitation one, and it is the kind of default that is safer to leave in place than to change silently in an upgrade. Reading the recorder is itself an act worth recording, which is the subject of attributable reads.
The refusal that still has a record
An agent proposes a £4,000 refund. The policy requires human approval above £500, so the request is parked and an approver rejects it with a written rationale. Nothing reached a model provider and no money moved. The record still exists: the request, the redaction pass, the policy decision with its reason, the approval request and its resolution with the approver’s identity and rationale, and the trace identifier returned on the refusal response so the agent’s operator can quote it. Now consider a recorder that opens only when a provider call succeeds. The estate’s evidence would contain every payment it made and none of the ones it refused — and the control that worked would be the one with nothing to show for it.
What flight recorder is routinely confused with
- Observability tracing
- Observability spans are emitted by the application to help engineers understand latency and errors: sampled, retained for weeks, and written by the process being described. A flight recorder is unsampled, written by the enforcement point, and kept as evidence. They look alike and differ in what you may claim from them — a sampled trace cannot answer whether an event occurred, only whether it was captured.
- Audit chain
- The chain covers administrative changes — who widened a permission, who engaged a kill switch. The flight recorder covers the requests judged against those rules. They are separated on purpose: the recorder holds the material you may be required to erase, and the chain holds the record of the erasure.
- Transcript
- A transcript reproduces the conversation. A flight recorder deliberately cannot, because it stores a redacted excerpt of the prompt and no answer text. If your record can replay a conversation, you have built a personal-data store with a retention problem rather than an evidence store.
Related terms
Audit chain
An audit chain is a record of administrative actions in which every entry carries a cryptographic digest computed over its own content and over the digest of the entry before it, so the entries form one linked sequence rather than a set of independent rows. Editing, reordering or removing an entry breaks that sequence at an identifiable point, which is what lets the integrity of the record be demonstrated rather than asserted.
Attributable read
An attributable read is a read of a sensitive record that is itself recorded as an event naming the identity that performed it, the query or scope it used, and how much data came back. It applies to looking the accounting normally reserved for changing, on the basis that access to a record of people’s activity is an exercise of authority rather than a passive act.
Digest-sealed export
A digest-sealed export is an evidence bundle issued together with a cryptographic digest computed over the canonical serialisation of its contents, so that a recipient holding that digest from another source can recompute it and confirm the file has not changed since it was issued. The seal establishes integrity relative to a value the recipient already holds; it establishes nothing about origin, because anyone able to rewrite the bundle can recompute the digest.
Tamper-evident
Tamper-evident describes a record whose alteration can be detected afterwards by whoever checks it. Tamper-proof would describe a record that cannot be altered at all — a property no scheme delivers over storage the alterer administers — so a claim of tamper-evidence means something only when it names the attacker it holds against and the check that would reveal the change.
Where Token Observe does this
The definition above is the field's, not the product's. This is the part of the product that implements it, for a reader who wants to see one.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
The filter cannot group, count or correlate across traces
Audit chain
Every administrative act hash-chained; seal it under a key held off the box, and anchor it with a signature your auditor can check alone.
Unkeyed, a rewrite that re-hashes everything verifies clean
Human approvals
One human decision, bound to one exact payload, spendable once.
An approval takes effect only when the agent retries
The terms next to this one
What a record of an agent's actions proves, and the several places where a word in common use claims more than the mechanism delivers.
Definitions are the easy part.
The glossary is written to be useful whether or not you ever buy anything. If you have got to the point of deciding how to implement one of these in your own estate, say what your agents do and you will get a straight answer about what it would actually take.
no form · no qualification step · no sales desk · the other three ways in