| name | ai-observability-audit |
| description | Create auditable AI operation summaries with run metadata, decision traces, and anomaly signals. Use when users ask for AI observability, periodic audit reports, incident reconstruction, or compliance-style activity tracking. |
AI Observability & Audit
Produce concise, consistent operational audit outputs.
Core audit fields
For each meaningful run/event, capture:
- timestamp
- actor/session
- task intent
- tools/actions executed
- result status (success/failure/partial)
- risk level
Never include secrets/tokens in logs.
Decision trace summary
When relevant, include:
- key decisions made
- why a path was chosen
- alternatives rejected (brief)
- approvals requested/granted/denied
Keep traces concise and human-readable.
Anomaly checks
Flag unusual patterns such as:
- repeated failures of same command
- sudden spike in privileged/destructive actions
- routing to unusual devices/nodes
- unexpected external-action attempts
Audit cadence
Support periodic reports (daily/weekly) with:
- counts by action type
- high-risk actions summary
- failure clusters and top causes
- remediation recommendations
Incident reconstruction
For incidents, provide a timeline:
- trigger event
- sequence of actions
- impact
- recovery steps
- preventive controls
Guardrails
- Prefer structured summaries over raw log dumps.
- Redact sensitive identifiers when sharing broadly.
- Never claim certainty when evidence is incomplete.
