Tool-Call Traces as Audit Artifacts

When an assistant's answer is questioned later, the transcript shows what was said. Only the tool-call trace shows what was computed — and the envelope inside it is the part that proves things.

A financial assistant built on verified models produces two records with different evidentiary weight. The conversation transcript records what the user asked and what the assistant replied — language, which paraphrases, hedges, and occasionally garbles. The tool-call trace records what was actually computed: which model, which inputs, which version, which outputs, under which constants. When the two disagree, the trace settles it, and a product that stores only the transcript has kept the testimony and discarded the evidence. This piece is the storage discipline for the part that proves things.

What a trace row contains

For every run_model call an assistant makes, store four things: the tool call as issued (model name and the inputs object), the full response envelope as returned, the timestamp, and a join key to the conversation turn that triggered it. The envelope does the heavy lifting — it already carries the specVersion, the echoed inputs, the outputs, the triggered sentinels, the assumptions, the cited constants, and the SHA-256 record, which means the trace row inherits the entire audit surface the platform builds into every answer. You are not designing an evidence format; you are declining to throw away the one the response came in.

The three-way reconciliation

The audit value comes from joining the layers. Question: did the assistant tell the user the right number? Reconciliation: the transcript's sentence, the trace's envelope outputs, and — months later, while the spec version is unchanged — a fresh run of the same model and inputs, which must reproduce the envelope byte for byte. (If the version has moved, recompute the stored record's hash instead: canonical JSON of model, specVersion, inputs, outputs — the envelope documents the procedure.) Three failure modes become distinguishable that a transcript alone collapses into one. If the trace's outputs match a fresh run but not the transcript's sentence, the assistant misstated a correct computation — a language-layer bug, fixed in the reply template. If the transcript matches the trace but the inputs are not what the user said, the assistant mis-extracted — a comprehension bug, visible because inputs are echoed. And if there is no trace row behind a numeric claim at all, the assistant answered from memory — the exact failure the tool-use posture exists to prevent, now detectable mechanically instead of by suspicion.

Retention and privacy posture

Trace rows follow the same rules as stored envelopes, because they contain one. Write them at trust-boundary moments — for an assistant, that is every reply a user sees that contains a computed number. Keep user identity in your conversation store, joined by key, not inside the trace. Retain on your records schedule; the trace is a business record about a computation. And keep raw inputs out of general-purpose logs — the trace store is access-controlled evidence, the log gets the record hash as a join key. Every element of that posture is developed in the envelope-storage and observability guides; the assistant setting changes none of it, it just multiplies the volume.

• ✓Store the envelope verbatim — it is the evidence format, already designed.
• ✓Join trace rows to conversation turns by key, both directions.
• ✓Verify the record hash once at write time.
• ✓Alert on numeric claims with no trace row behind them.
• ✓Retain traces like envelopes — records schedule, identity outside, access controlled.

Why this is cheap and the alternative is not

The marginal cost of trace storage is a table and a few kilobytes per computed answer — the envelope arrives whether you keep it or not. The alternative cost arrives all at once, later: a user disputes an answer, a reviewer asks how often the assistant's numbers come from tools, a regulator asks what the tool told this person on this date — and the product with transcripts but no traces gets to reconstruct computations from prose. The trace turns each of those from a project into a query. Testimony plus evidence is an audit surface; testimony alone is a liability with good grammar.