AI code audit trail
also: AI-generated code audit · AI authorship audit log
An AI code audit trail is a durable, queryable record of AI-authored changes over a codebase's history — which agent wrote what, when, under what policy, and whether that record was signed. It provides the evidence security and compliance teams need to answer authorship questions during an audit or incident.
What auditors are starting to ask
Controls reviews increasingly include a new question: not just "who approved this change," but "did an AI generate it, and under what controls?" Answering "the AI did it" is not acceptable evidence. An AI code audit trail makes the answer concrete, specific, and verifiable.
Under the EU AI Act, transparency obligations push providers to preserve provenance information throughout a content's lifecycle and prevent its removal — and software code is in scope. An audit trail of AI authorship is how a team demonstrates that provenance was preserved.
Properties of a usable audit trail
- Durable — it persists with the repository and cannot be silently dropped.
- Queryable — you can ask "show every AI-authored change to the payments service since January" and get an answer.
- Signed — entries are tamper-evident, so the trail is trustworthy.
- Low-friction — it is produced automatically at commit time, not assembled by hand after the fact.
An audit trail that lives in git
AgentDiff stores each signed attribution in a git ref beside your code, so the audit trail is portable across remotes and exports and requires no separate system of record. You can query it from the CLI, open it in a dashboard, or pull the traces straight from git.
$ agentdiff report --since 30dclaude-code 61% ✓ signedcursor 19% ✓ signedhuman 20%
Frequently asked questions
Do compliance frameworks require AI code attribution today?+
No current framework (SOC 2, ISO 27001, PCI-DSS, HIPAA) explicitly mandates AI authorship disclosure yet. But ISO 42001 and the EU AI Act are moving toward stronger traceability requirements, and auditors are beginning to ask authorship questions during controls reviews.
How is an AI code audit trail different from git history?+
git history records commits and committers but has no concept of which AI agent generated a change or whether that record is signed. An AI code audit trail adds agent, model, policy context, and signatures on top of git.
Where is the audit trail stored?+
AgentDiff stores it as signed records in a dedicated git ref inside your own remote, so it stays under your control and travels with the repository.
See line-level provenance on a real repo.
AgentDiff records which agent wrote which line, signs it, and keeps it in your git history. Open the live dashboard or book a walkthrough.