How do I keep an audit trail of what our AI coding agents did?

What Claude Code, Codex and Cursor record on their own, what OpenTelemetry export adds, and why a record written on the agent's own machine is not yet evidence.

An audit trail has to answer four questions later: which agent did what, on whose machine, when, and how you know the answer was not changed afterward. The agents record a good deal already. Start there.

What the agents record themselves#

Claude Code writes each session's transcript to a JSONL file under ~/.claude/projects/ on the developer's machine. By default it deletes transcripts older than 30 days; the cleanupPeriodDays setting changes that.
Codex writes its sessions to files under ~/.codex/sessions.
Cursor keeps chat history inside the app on each machine.
Git records what was committed, by whom, and often which agent helped, through commit trailers.

These are useful for a developer looking back at their own work. Copy them early when something goes wrong, before cleanup removes them.

OpenTelemetry export#

Claude Code can export events and metrics over OpenTelemetry to any collector you run. Set it in the env block of the settings file, or in managed settings so it applies to everyone:

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel.example.com",
    "OTEL_LOG_USER_PROMPTS": "1"
  }
}

That gives you a central, searchable stream: prompts (only with OTEL_LOG_USER_PROMPTS), tool results, model requests with tokens and cost, and errors. For many teams, a collector feeding the log store they already run is the right first step.

What those do not give you#

The writer is the thing being audited. A transcript lives on the machine the agent controls, in files its own shell can edit or delete. Telemetry is sent by the same process whose actions it describes. If the agent was hijacked, or someone wants a session to look different, nothing shows the edit.
No proof of completeness. A log line that is missing looks the same as one that never existed. Nothing chains one entry to the next.
Many formats, many places. Each agent records differently, on each machine. Pulling one incident together means collecting files from laptops.
Content and record are mixed. Prompts and outputs can hold secrets and personal data, so the full stream is often too sensitive to keep in a general log store for long.

For an operational view, those gaps may be acceptable. For an incident or an auditor they are the questions you will be asked; see How do I prove what an AI agent did?

Where Golem fits#

Golem records from outside the agent. The Golem agent, a service on each machine, receives every call through the agent's hooks and through Golem's MCP gateway, and signs an entry for it before anything leaves the machine.

Signed by Golem, not by the agent. Each entry is canonical CBOR in a COSE_Sign1 envelope (ES256), signed with a key tied to the enrolled machine. The agent being watched never holds that key, so it cannot write or rewrite its own record.
Chained. Each entry carries the hash of the one before it, so a change, a removal or a reordering breaks every link after it. A Merkle root over every chain's tip is taken every 15 minutes when anything changed.
Content kept apart. The record holds each payload's SHA-256. The raw payload goes to your own bucket, or Golem's storage under your workspace's key, and is checked against that hash when it is read back. See Where your data goes.
One place for every agent. Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI, Devin, Antigravity, Hermes and OpenClaw sessions land in the same record, with the machine and agent named on each entry.
Offline survives. Entries the Golem agent cannot deliver wait in a local queue and are sent when the machine reconnects, for up to 24 hours and 1 GiB.

High-frequency measurements (model requests, token counts, cost) are signed but not chained. Golem calls them ticks and treats them as metrics, not evidence.

What Golem does not record#

Claude Code's prompts and replies, unless you turn on its OpenTelemetry export and point it at the Golem agent. The hooks carry tool calls and results.
Commands you type yourself, and AI tools Golem is not wired into. Those tools still appear, by name and machine, under Shadow AI.
The record is tamper-evident, not tamper-proof. A passing check means nothing was changed after signing by anyone without the signing keys.

The exact per-agent coverage is in Coverage.