auditable ai executionai agent audit trailhuman-in-the-loop ai agents
Auditable AI Execution: Traces, Review Queues and Human Halt Points
What a risk team should see before signing off an AI delivery partner: the per-action trace schema, review-queue rules and human halt points in the delivery loop.
Nov 13, 2026
Last updated: Nov 13, 2026
Auditable AI Execution: Traces, Review Queues and Human Halt Points
By Shiva Mangal, Founder, Grail Computer Labs. Published 28 October 2026. Grail Computer Labs is an applied-AI and digital product research lab in Singapore. Author profile: LinkedIn.
Auditable AI execution means every action an AI agent takes leaves a structured, attributable record that a reviewer can reconstruct, and every consequential action can be halted by a named human before it is committed. That is the standard a risk team should hold a delivery partner to.
Most partners promise it. Few show it. In Grant Thornton's 2026 survey, 78% of executives lacked strong confidence they could pass an independent AI governance audit within 90 days (Grant Thornton, 2026). The report puts the gap plainly: "Organizations that are deploying AI can't show how decisions are made and who is accountable for the outcome." (Grant Thornton, 2026)
This article is for a risk team that needs to see the evidence. We walk the delivery loop used by Grail Computer Labs (GC Labs): Triage → Specify → Implement → Review → Verify → Release. At each stage we show what to ask for.
Key Takeaways
Auditable AI execution rests on three inspectable things: a per-action trace, a review queue with escalation rules, and named human halt points.
A useful AI agent trace records the approver, the approved input hash, the executed input hash, the policy version and both timestamps, not just the final output.
Human validation of AI agent outputs is now a majority requirement among US organisations, which raises the load on every review queue (KPMG US, 2026).
An AI delivery partner should be able to show a real trace, the review queue and the halt point before a risk team signs.
An auditable AI trace proves what happened, not that it was right, so review quality has to be measured separately.
What Should Be in an Audit Log for AI Agent Actions?
A per-action trace is a structured record written at the moment an AI agent acts, covering who acted, on what input, under which policy and with whose approval. The Cloud Security Alliance reports that only 28% of organisations can trace agent actions back to a human sponsor across all environments (Cloud Security Alliance, 2026).
Close view of a printed ledger page with ruled columns and a steel ruler marking one line
A chat transcript is not a trace. GC Labs' own control page on audit trails makes the same point at a high level. Here we go field by field. The nine-field trace schema below lists what a risk team should expect in each record.
Field
What it records
Why a risk team needs it
Trace ID and loop stage
A unique ID and the stage (Triage to Release)
Lets an auditor follow one change end to end
Agent identity and version
Which agent, which model, which configuration
Shows what acted, so behaviour can be compared across versions
Accountable human sponsor
The named person responsible for the agent
Answers "who is accountable"
Action and tool
The call made and the system it touched
Defines the blast radius of each step
Approved input hash
A hash of the input the human saw
Fixes what was approved
Executed input hash
A hash of the input that actually ran
A mismatch with the approved hash shows the action changed after approval
Policy version
The rule set in force at the time
Allows an action to be tested against the rules of that day
Approver and timestamps
Who approved, when, and when execution began
Proves approval came before execution
Outcome and reversibility
Result, and whether the action can be undone
Drives the halt-point decision
An approved input hash is a fixed-length fingerprint of the exact input a human saw when approving. If the executed input produces a different fingerprint, the action changed after approval, and the trace shows it.
What the standards say about trace formats
OpenTelemetry GenAI semantic conventions are an open vocabulary for describing agent runs. They define invoke_agent, chat and execute_tool spans, but they remain at Development stability, so attribute names can still change. One example: gen_ai.system was replaced by gen_ai.provider.name (Nango, 2026). A risk team should ask which schema version a partner writes, and how it migrates old records.
GC Labs records agent traces and masks likely secrets before they reach an agent. We do not publish the internal record layout, so treat the nine-field trace schema as the list of fields to request, not a description of ours.
Where Can a Human Halt AI Execution in the Delivery Loop?
A halt point is a place in the delivery loop where execution stops until a named human approves, and it belongs before any action that cannot be undone. KPMG's Q1 2026 pulse found 63% of US organisations now require human validation of agent outputs, up from 22% in Q1 2025 (KPMG US, 2026).
Lollipop chart: Share of organizations requiring human validation of AI agent outputs (US). Highest: Q1 2026 at 63%.
A tripling of human validation in a year means more items reach reviewers. Every queue that sits behind a halt point needs tiers and response limits, or it becomes the bottleneck the next section describes.
Human-in-the-loop (HITL) means a person must approve an agent's action before it runs. Human-on-the-loop means a person monitors and can intervene, but the agent proceeds by default. The distinction decides whether a deployment is supervised or autonomous.
The halt-point gate can sit on the plan (Specify) or on the tool call (Release), and a supervised deployment needs both. A plan gate catches a wrong goal before any work starts, but it cannot see what the agent later does with its tools. A tool-call gate catches the actual action, but by then a flawed plan has already shaped it. The halt-point map below puts a gate at both, tied to how reversible each stage is.
Stage
Example consequential action
Halt point to demand
Reversibility
Triage
Classifying a request as low or high risk
Risk tier recorded with the reason
Easy to reverse
Specify
Agreeing what "done" means
Named human approves the specification
Easy to reverse
Implement
Changing code or a workflow
Agent works with read-only or sandboxed access first
Reversible if isolated
Review
Merging a change
Engineer review of every change
Reversible with rollback
Verify
Declaring the work complete
Tests reject incomplete work
Reversible
Release
Pushing to production, moving money, allocating a shift
Explicit human release approval
Often irreversible
GC Labs' stated principle is "Agents execute · humans decide · customers see progress". Its engineers review every change, tests reject incomplete work, and access can begin read-only. The Release stage carries the highest stakes. Anything touching payments, credential checks or shift allocation in a healthcare or fintech platform sits there. A finance team asking what controls an agent needs before it can approve or initiate a payment should start with dual approval at that stage.
How Should a Review Queue Handle Escalation and Approval Fatigue?
A review queue is the ordered list of agent actions waiting for human approval, with rules that decide who sees each item and how fast. Human approval is the default design: Riverbed's 2026 survey found 77% of organisations hesitate to let AI make operational decisions without it (Riverbed, 2026).
A hinged safety cover lifted over a toggle switch on a grey control panel
The Riverbed survey covers IT operations, so it is supporting evidence, not proof for regulated workflows. Grant Thornton's survey adds a sharper line: only 5% of organisations let agents execute high-stakes decisions without human review, and 60% limit agents to moderate-risk task automation (Grant Thornton, 2026). Human review queues are therefore the norm in enterprise AI deployments. The risk is a queue with no rules.
Approval fatigue is the decay of review quality when reviewers face too many low-value approvals and start clicking through. Queue design is the control against it.
Queue rules to ask for
Risk-tier routing. Low-risk items auto-proceed with a logged sample. High-risk items always wait.
Response-time limits. Each tier has a deadline, and an expired item escalates to a second person.
Dual review for irreversible actions. Two named approvers for payments or production release.
Sampling of auto-approved work. A fixed share is re-reviewed to catch drift.
Override-rate monitoring.Override rate is the share of agent proposals a reviewer changes or rejects. A rate near zero for one approver can mean rubber-stamping.
Decoy tests. Seeded bad proposals show whether reviewers catch them.
Singapore's IMDA updated its Model AI Governance Framework for Agentic AI on 20 May 2026. The update refines guidance on checkpoints that need human approval and adds measurable indicators such as human override rates and response times (Inside Global Tech, 2026). Rules 2 and 5 map directly to those indicators.
Our data: In a human-reviewed know-your-transaction (KYT) workflow built for a Singapore-based neobank, a one-week build raised automated approvals from approximately 44% to approximately 90% in testing. The manual review it replaced took 30+ minutes. These are GC Labs' own customer figures, not independent research.
The lesson is narrow. Automation rose, but the human review stayed where judgement sat.
How to Prove a Human Approved an AI Agent's Action Before It Ran
Proving that a human approved an AI agent's action before it ran takes three recorded facts: an approval timestamp earlier than the execution timestamp, a hash of the input the human saw, and a hash of the input that ran. Matching hashes and a named approver show the approved action is the executed one.
The named approver is the weak link in practice. The Cloud Security Alliance found only 28% of organisations can trace agent actions back to a human sponsor across all environments (Cloud Security Alliance, 2026). A log that only says "approved" is weak evidence. The approval has to be bound to the exact input. Four checks make that provable:
The approver is a named person, not a shared service account.
The approval timestamp precedes the execution timestamp in the same trace.
The approved input hash equals the executed input hash.
The policy version on the record matches the rule set in force that day.
If any check fails, the action is an exception, and it goes to a named human for explanation. A risk team should ask a delivery partner to run this check live on one real action, not describe it in a slide.
How Does Automated Evidence Collection Map to EU, MAS and IMDA Expectations?
Automated evidence collection is the process of turning agent traces and approval records into documents an auditor can read, without staff assembling them by hand. Its deadlines are set by regulators: the EU Digital Omnibus moved Annex III high-risk obligations, including Art. 12 logging and Art. 14 human oversight, to 2 December 2027 (Orrick, 2026).
A row of paper tags clipped to a rail, one pulled forward for inspection
An evidence pack is the set of traces, approvals and test results that shows a control operated over a period. The pipeline from trace to pack has five steps:
Each agent action writes a trace at execution time.
Traces are grouped by control (for example, "payments need dual approval").
Each group is checked against its rule: was approval earlier than execution, and did the hashes match?
Exceptions go to a named human for explanation.
The pack is exported with a retention date and an owner.
The regulator map below shows the evidence each instrument implies. Check every date against the primary source before relying on it. The MAS effective date in particular comes from a secondary-source summary, and we have not confirmed it on the MAS website.
Instrument
Date
What it means for evidence
EU AI Act (Digital Omnibus)
Annex III obligations moved to 2 December 2027; Article 50 transparency still applies from August 2026 (Orrick, 2026)
Art. 12 logs and Art. 14 oversight records must exist before then
MAS Guidelines on AI Risk Management
Final guidelines issued October 2026, reported effective 7 October 2027 by a secondary source (Lexology, 2026); unconfirmed, verify on mas.gov.sg
Human oversight across the AI lifecycle, AI inventories, risk-materiality assessment
Override rates and response times as measurable indicators
Oversight has to be real, not decorative. An evidence pack that shows approvals with no override history and no response times will not persuade a reviewer that a human was in control.
How to Assess an AI Delivery Partner's Audit Trail Before Sign-Off
To assess an AI delivery partner's audit trail, ask to see three things before sign-off: a real trace for a real action, the review queue with its escalation rules, and the exact point where a human can halt execution. Grant Thornton found 78% of executives lack strong confidence they could pass an independent AI governance audit within 90 days (Grant Thornton, 2026).
A stack of sealed document folders with a checklist and pen on top
Use this partner-assessment checklist in the sign-off meeting.
Ask
Evidence to request
Red flag
Show one real trace
A redacted trace with all nine fields of the trace schema
Only a chat log or a final output
Show the queue
Tier rules, response limits, override-rate report
"Reviewers use their judgement"
Show the halt point
The stage, the approver, the reversibility
Halt is a policy document, not a block
Prove approval came first
Approved versus executed hash, both timestamps
Approval recorded after the fact
Show data handling
Where data lives, retention, secrets masking
No answer on retention
Show exit rights
Who owns code, cloud, models and documentation
Records stay with the vendor
Then test it on live work. GC Labs starts with an outcome engagement: one pre-defined outcome agreed before work starts and delivered in 4 to 8 weeks, with a 15-day trial and no payment commitment. A risk team can inspect real traces from that outcome before committing further.
Our data: GC Labs' customer data shows 500 bug and feature tickets handled across a 10-day period in its rescue of an Australian healthcare platform (GC Labs case study, 2026). This is GC Labs' own figure, not independent research.
That is the volume at which a trace and a queue either work or collapse. Separately, GC Labs states that its engineers review every change and that tests reject incomplete work. The case study does not report review figures for the 500 tickets, so we do not link the two.
Where Does Auditable AI Execution Fall Short?
Auditable AI execution has limits that a risk team should price in: a trace proves what an agent did, not that the action was right, and human review can decay into rubber-stamping. Deloitte found approximately 80% of surveyed organisations lack mature governance for agentic AI, so a partner's claims need inspecting (Deloitte, 2026).
The Deloitte gaps include approval boundaries, real-time monitoring and audit trails that capture the full chain of agent actions. A partner can write perfect traces and still leave ownership unclear on the client side.
Four limits are worth stating plainly:
Standards still move. OpenTelemetry GenAI attribute names can change while the conventions sit at Development stability.
Review quality is measurable but not assured. Override rates and decoy tests show decay. They do not prevent it.
Traces are not judgement. A complete record of a wrong decision is still a wrong decision.
Unpublished detail stays unpublished. We describe governance properties of the Software Factory, not its internals.
GC Labs also holds no SOC 2, ISO 27001 or HIPAA certification. Assurance comes from case evidence and a client-side security assessment, which GC Labs will complete during onboarding. This approach is not for teams that want an agent to act in production with no human decision at any stage. It does not replace a client's own control framework, and the client still owns the risk call.
Frequently Asked Questions
What should be in an audit log for AI agent actions?
An audit log for AI agent actions should record the agent identity and version, the accountable human sponsor, the action and tool called, the input hash at approval and at execution, the policy version, the approver and both timestamps, and the outcome. A chat transcript alone does not carry these fields.
How to prove a human approved an AI agent's action before it ran?
A team proves prior approval by recording an approval timestamp earlier than the execution timestamp, plus a hash of the input the human saw and a hash of the input that actually ran. If the two hashes match and the approver is a named person, the record shows the approved action is the executed one.
What should a compliance officer ask an AI delivery partner before sign-off?
A compliance officer should ask the partner to show a real trace for a real action, the review queue with its escalation rules and override-rate reporting, and the exact point where a human can halt execution. They should also ask what evidence the partner can export and who owns it after the engagement.
Does Grail Computer Labs hold SOC 2 or ISO 27001 certification?
No. Grail Computer Labs holds no SOC 2, ISO 27001 or HIPAA certification. It is an OpenAI Select Partner (self-claimed on its website) and completes vendor security and compliance assessments as part of onboarding, with agent traces recorded for client review.
Conclusion
Auditable AI execution is something a risk team can test in one meeting, if it asks for the right artefacts.
Demand a per-action trace with approver, approved and executed hashes, policy version and timestamps.
Map a halt point to each stage of the delivery loop, and put the strictest one at Release.
Check the review queue for tiers, response limits, sampling and override-rate reporting.
Require an evidence pack that can be exported, not assembled by hand.
Accept that traces prove what happened, and measure review quality separately.
We agree the outcome first, deliver it in 4 to 8 weeks, then keep shipping. To see a trace, the queue and a halt point on a real workflow, Book a call ↗.
