Your Agent Followed the Guardrail. Can You Prove It?
We wrote a few weeks ago about why sandbox failures should change how you think about AI agents, and about deciding which of your workflows an agent may touch. Both posts are about controls: what an agent is allowed to do. There is a second, quieter question that most SMEs have not gotten to yet. Once you have decided what an agent may do, how do you prove what it actually did?
The gap between a policy and a receipt
A recent ISACA piece put this plainly: a governance policy expresses intent, not proof. You can write a one-page AI use policy, list who reviews outputs, and still have nothing to show an auditor, a client, or your own team the day something goes wrong. A policy says what should happen. Only a log says what did happen.
This is not a hypothetical distinction. NIST launched an AI Agent Standards Initiative earlier this year specifically to define identity, authorization, and audit expectations for autonomous agents, and the EU AI Act’s logging requirements for high-risk systems became enforceable in August. Neither of those bodies is thinking about a 20-person consultancy or a mid-sized distributor. But the underlying question they are both circling, can you reconstruct what an agent did and why, applies at any size the moment an agent touches money, stock, or customer data.
Guardrails answer “what was stopped.” Audit trails answer “why.”
A guardrail is a fence. It blocks the agent from posting to a locked window, sending an email over a certain value, or writing to master data. That matters, and we have argued for exactly this kind of least-privilege thinking before. But a fence only tells you what did not happen. It says nothing about the hundred actions the agent was allowed to take and did take. If an agent flagged forty invoices as exceptions this week and auto-approved sixty more, a guardrail has nothing to say about whether that split was the right call. An audit trail does, because it recorded the input, the data the agent pulled, the reasoning it used, and the action it took.
What a usable trail actually needs, at SME scale
You do not need an enterprise observability platform to get most of the value. Three things, kept simple, cover the SME case:
Capture the decision, not just the outcome. For each significant action, record what the agent looked at (which invoice, which customer record), what it concluded, and what it did about it. Two lines in a log table is enough if it is consistent.
Attribute every action to an identity. Not “the AI did it.” Which agent, running under which role, on whose behalf. If your ERP already has a permission model, as Openbravo and Etendo do, run the agent through that same identity layer rather than a shared service account. Then the trail you already generate for human users covers the agent too.
Review it on a cadence, not just after an incident. A log nobody reads is a liability with extra steps, because it proves you had the evidence and did not act on it. A short weekly look, even ten minutes, at what agents touched and flagged is enough to catch drift before it becomes a finding.
Where this bites hardest in ERP
This lands hardest in agentic ERP specifically, because the actions in question post to the ledger, adjust stock, or touch a customer balance. We have made the case before that agentic ERP has to start with governance rather than bolt it on after go-live, and the audit trail is the part of that governance you cannot fake with a good policy document. If you are running or modernizing an Openbravo or Etendo environment and adding agent-driven workflows to it, the trail should live in the platform’s own audit log, tied to the same roles and windows your human users already work in, not in a separate spreadsheet someone updates when they remember.
If you are migrating toward Etendo as part of this, our migration guide covers the groundwork. And if you want a second pair of eyes on whether your current agent rollout could actually answer “show me what happened” for last week, our free ERP & AI Readiness Assessment is built to walk through exactly that.