How to Audit What an AI Agent Said to a Customer, and Why

This article is for informational purposes only and does not constitute financial, tax, or legal advice. Consult a qualified professional for guidance specific to your situation.

Reviewed for financial accuracy by the Startup Finance Guide editorial team. Our editors cross-reference all claims against platform documentation, pricing pages, and primary regulatory sources. Last reviewed: November 2, 2026.

To audit what an AI agent said to a customer and why, you need three records rather than one: a verbatim message log, a decision trace, and product behaviour data measured against a holdout group. Export the raw message log from the platform's API, read the trace to find the condition that fired, compare both against the campaign as approved, check the guardrail log, replay the message inside the product, and measure the behaviour change. Two of those records cannot be reconstructed after the fact, which is why the audit has to be set up before the first message goes out.

An agent tells a customer the product does something it does not, and a renewal now hangs on that message. Nobody can say exactly what was sent, which rule triggered it, or who approved it. The dashboard shows "sent". That is not an answer a customer, a compliance officer or your champion will accept. IBM makes the same point in its work on agent trace layers: logs tell you whether a system is running and metrics tell you whether models are performing, and neither explains how a decision led to a real-world consequence.

Key takeaways

• An audit proves three things: what the agent said, why it said it, and what happened next. Different records answer each.
• A log records what happened. A trace records the chain of steps that produced it. You need both, because a log cannot explain a decision.
• The approved campaign snapshot and the holdout group are the two pieces you cannot create retrospectively. Freeze the first and reserve the second before launch.
• Define success as a product action, not an open or a click. Inbox privacy features have made open rates close to meaningless.

The six steps

1. Export the verbatim message log

Start with what the customer actually saw. Pull a raw export from the platform's API or event log rather than a dashboard summary, carrying a UTC timestamp, a session or user ID, and the full rendered message text with every variable filled in. If the platform stores the model output before trimming or re-ranking, export that too.

Then read it. You are looking for invented feature names, pricing promises nobody approved, and variables that failed to populate. This gives you one source of truth for what was said.

2. Read the decision trace to find the trigger

The log says what. The trace says why. Open the rule or execution log for the session and work through four checks: find the exact condition that fired, such as a usage flag, an inactivity window or a plan tier; confirm the user genuinely met that condition at that moment; compare the rendered message with the approved template to catch any rewrite the model made on its own; and save the trace entry alongside the log entry under the same session ID.

IBM's guidance on what a trace should carry is a useful shopping list when you are asking a vendor what they expose: the actual prompts, the retrieved chunks and their metadata, the parameters and returns of every tool call, the decision logic at each step, and a single run identifier that ties the whole chain together across services. It also argues traces should capture side effects, the records changed and emails sent, linked back to the run that caused them.

When this step is done, "the system decided" has become a specific, citable rule.

3. Compare live execution against the approved campaign

Campaigns drift after sign-off. Somebody widens an audience, edits a template, raises a send limit. The comparison is simple and catches all of it.

Export the approved configuration on the day it is signed off, as a PDF or JSON. Pull the live configuration for the audit period. Compare the audience filter, the message template, and the send limits and timing. Check that every mandatory disclosure line still appears in sent messages. Count messages per customer per week against the approved cap.

Any difference is a finding. No difference means the agent ran what was reviewed. Platforms built around an approved campaign brief, such as Lumi by Userlens, give you that snapshot by design rather than by discipline.

4. Audit the guardrail state log

Guardrails only count if they were enforced. Export the guardrail records and check each control: that a test of the kill switch halted outbound messages and was logged; that per-customer frequency caps held across all active campaigns rather than one; that quiet hours were respected in each customer's own time zone; that no never-contact flag received a message; that every blocked message carries a disposition reason, such as "daily cap reached"; and that every manual override records an operator name and timestamp.

Worth knowing where the regulatory wind is blowing: the AI Kill Switch Act, introduced in the House in July 2026 by Representative Ted Lieu and co-sponsored by Representative Nathaniel Moran, would require developers of the largest AI systems to maintain reliable shutdown controls, report qualifying incidents within 15 days and preserve model weights after an emergency order. It applies only to systems developed with more than $100 million in compute by companies earning at least $500 million a year from the technology, so it reaches almost no SaaS team, and it remains a bill rather than law. It is a signal about expectations, not a compliance deadline.

5. Replay the message inside the user flow

A message can look correct in a preview and still fail in the product. Open the session in a replay tool and watch it.

Find the session from the timestamp and ID in the message log. Check whether the message appeared before or after the user took the action it was meant to prompt. Look for collisions with modals, tooltips or a confirmation button. Confirm the feature it mentions was actually reachable from where the user was standing. Mask personal data in the stored clip, and delete it when the review closes.

This is the step that distinguishes a message that was right on paper from one that worked.

6. Tie each message to a behaviour change

This turns a compliance exercise into a business answer. Join the message log to your product analytics on a shared user ID, define success as a product action rather than an open or a click, set a fixed window such as seven days, keep a small holdout group that receives nothing, and subtract the holdout rate from the exposed rate.

Message variant	Holdout rate	Exposed rate	Lift
Variant A	Measured from holdout	Measured from exposed	Difference between the two
A compliance officer wants proof the agent stayed inside its bounds. A champion wants proof it moved a number. Steps 1 to 5 answer the first question, and only this one answers the second. Our guide to measuring AI agent ROI goes deeper on which numbers survive scrutiny.

Five tools, mapped to the steps

Lumi by Userlens

A customer adoption agent for B2B SaaS that connects a backend database with product analytics from PostHog, Mixpanel or Amplitude, then sends email or Slack nudges inside a campaign a person approved.

For auditing, the relevant parts are the approval record (goal, audience, tone, exclusions and limits fixed once per campaign, giving you the step 3 snapshot), controls enforced before sending (frequency caps, quiet hours, never-contact flags, skip-if-unsure rules, plus a kill switch, which covers step 4), and a scoreboard tracking whether the target adoption behaviour moved, which feeds step 6.

The limit: it is scoped to adoption messaging, so it is not where a general-purpose agent gets audited.

Langfuse

Open-source tracing and evaluation. Hierarchical traces capture every model call, tool call and retrieval step, covering steps 1 and 2, and runs can be filtered by user, session, cost, latency or custom metadata to find the single message under investigation. It works with OpenTelemetry, can be self-hosted free, and its hosted free tier covers 50,000 units a month, counting traces, observations and scores together rather than observations alone.

LangSmith

Observability that works with any framework rather than only LangChain. Message threading keeps multi-turn customer conversations together for step 1, online evaluations score outputs in production so off-script messages surface during steps 2 and 3, and webhook and PagerDuty alerts flag problems early. Self-hosted and bring-your-own-cloud options matter for data residency.

Arize Phoenix

Open-source tracing and evaluation, and the strongest pick when customer data has to stay inside your own environment. It exposes the prompts, retrievals, tool calls and outputs behind each response for steps 1 and 2, supports annotation by human reviewers or an LLM judge, and can run locally so traces never leave your infrastructure.

Fullstory

Session replay, funnels and product analytics, covering the part of the audit that logs cannot reach. Watch the session tied to a message timestamp and see whether the message collided with a modal or tooltip in step 5, then use funnels for extra evidence on what the user did next in step 6.

Start with the gap that worries you most. If you cannot see why a message fired, start with tracing. If you cannot prove impact, start with measurement.

Limitations

Tool capabilities and pricing come from each vendor's own documentation as checked in November 2026 and move quickly. We have not run this audit end to end on any of these platforms, so nothing here reports on how well the exports hold up at volume. Retention and privacy requirements vary by jurisdiction and by contract, and the data protection question around storing message transcripts and session replays is one for your own counsel rather than a checklist. The AI Kill Switch Act is described as introduced, not enacted.

Frequently asked questions

How long should message logs be retained?

As long as your contracts, privacy policy and applicable regulation require, which commonly means the contract term plus the window in which a dispute can be raised. Confirm the exact period with your legal team, and delete replay clips sooner, since they carry far more personal data than a text log.

What is the difference between a log and a trace?

A log records what happened: a message sent at a time. A trace records the chain that produced it, including the rule that fired and the data retrieved. An auditor asking "why" cannot be answered from logs.

Does a holdout group hurt results?

It costs a little reach and buys the only clean evidence of causation you will get. Keep it large enough to compare fairly and small enough not to matter commercially. Without it you can show activity, never impact.

How should customer data in transcripts and replays be handled?

Restrict access to the people who need it, mask personal data in replay tools, and set a deletion date on every stored record. An audit that creates a new data risk has not improved your position.

What should be in place before the agent sends anything?

The guardrails themselves, which our guide to guardrails for an AI agent that emails customers sets out, plus the three audit artefacts: a frozen approved configuration, a defined success action, and a reserved holdout group.

Conclusion

Most teams treat the audit as something they run after a complaint. That is the weak point, because two pieces of evidence cannot be rebuilt later: you cannot recreate the approved campaign snapshot once somebody has edited it, and you cannot construct a fair holdout group after the messages have gone.

Make the audit setup a launch requirement instead. Freeze the configuration, decide the success action, reserve the holdout. When the hard question arrives, the answer is already on file.

---

Tool capabilities and pricing come from each vendor's own documentation as checked in November 2026 and change quickly. Retention and privacy requirements vary by jurisdiction and contract, and the AI Kill Switch Act described here is an introduced bill rather than enacted law.

How we built this guide: the audit sequence is drawn from vendor documentation and IBM's published work on agent trace layers, and every vendor capability and figure here was checked against current documentation rather than a marketing page.