The evidence problem
When decisions are scattered across messages and tickets, reconstructing an audit trail takes time. Staff changes can also make it harder to explain why an action was approved.
Record agent recommendations, human approvals, and resulting changes as work happens. Verify retention, access controls, and export completeness; a log should not be described as immutable without tested integrity controls.
What the log actually contains
The trigger, the agent that responded, the reasoning it produced, the action proposed, who approved or declined it, and the resulting state change — with timestamps you did not write.
Takeaway. Collect evidence during the work, then check that it supports the control and review questions your auditor actually asks.