Capturing Intent: Audit Logging for Autonomous Agents in Fragmented Environments

Secrets management for non-human identities is architecturally solved and operationally miserable, and it is still not the interesting problem. Short-TTL tokens, workload identity federation, and SPIFFE/SPIRE work the same for an AI agent as for a CI runner. The crisis with autonomous agents is not how they authenticate. It is why they execute.

A human requests access with a reason and a system validates it. An agent requests access because it decided to, adapting its path mid-execution. When an external API is blocked or times out, the agent may pivot to a local data path using an entirely different credential set. Your audit log records that production data was touched. It cannot record why the pivot happened. Standard logging captures actions and completely fails to capture intent.

This talk proposes an architecture for intent-attributable audit logging: committing signed reasoning traces to an immutable ledger before dynamic credential issuance, and linking Vault's issuance logs to the model's prompt-response trace. It also confronts the hard limit - a signed trace attests a claim about intent, not intent itself - and what that means for forensics.