What is an Audit Log?

While the audit trail is the conceptual record of agent activity, the audit log is the concrete implementation — the actual structured data that PolicyLayer writes for each tool call. The distinction matters because the log format, content, and destination directly affect what you can do with the data.

PolicyLayer's audit logs are structured JSON by default, making them machine-parseable and compatible with every major log aggregation platform. Each log entry is self-contained — you can understand a single entry without needing context from other entries. This is important for log systems that may process entries out of order or across different time windows.

The audit log differs from application logs in purpose and audience. Application logs help developers debug software. Audit logs help organisations prove governance, investigate incidents, and understand agent behaviour. They are designed to answer "who did what, when, and was it allowed?" — questions that come from security, compliance, and operations rather than engineering.

PolicyLayer writes audit logs as structured JSON to stdout by default, following the twelve-factor app convention. Each entry includes: ISO 8601 timestamp, request ID, MCP server name, tool name, sanitised arguments, matched rule ID, evaluation result, conditions checked, and latency. The output can be directed to files, syslog, or piped to log aggregation agents. PolicyLayer supports configurable log levels — minimal (action and tool only), standard (full evaluation details), and verbose (including raw arguments and full rule matching trace).