The security log needs the intent

Security logs are good at verbs. A process opened a file, called an endpoint, created a branch, changed a permission, or sent a request. Investigators can reconstruct a sequence with impressive precision and still fail to answer the first human question: was the system supposed to be doing this?

For deterministic software, intent is often embedded in the application. A payroll job reads payroll records because that is the fixed purpose of the job. An agent is different. The same runtime may reconcile invoices in the morning, prepare a report at noon, and inspect a repository at night. The action acquires meaning from the task, principal, and mandate active at the time.

Current guidance on coding-agent telemetry recognizes that prompts, approvals, tool results, and network behavior all contribute to operational understanding. The next step is to preserve their relationship. A prompt alone is not policy, an approval alone is not purpose, and a tool event alone is not an explanation. Security comes from joining the layers.

Anomalies depend on purpose

Reading ten thousand files may be normal for an indexing task and alarming for a one-line documentation edit. Connecting to a package registry may be expected during dependency resolution and unexpected during a local formatting pass. Volume and destination are weak signals until the monitor knows what work was authorized.

This is why generic anomaly detection struggles with agents. Their legitimate behavior is broad and changes by assignment. A baseline built from the agent identity averages together unrelated tasks. The result either alerts on every ambitious job or learns that nearly anything is normal.

The event says what happened; the mandate says whether happening belonged to the job.

Intent should enter the log as structured context, not a paragraph that must be interpreted later. NIST’s agent identity and authorization concept work joins authorization with auditing and non-repudiation; the operational record needs fields that make those joins possible. Useful context includes the principal, objective, approved resources, consequence class, expected destinations, time window, human checkpoints, and policy version.

The monitor can then detect divergence rather than mere activity. A tool call may be individually allowed but outside the current task. A network destination may be broadly approved but unrelated to the objective. A write may be reversible but occur after the mandate expired. These are security-relevant mismatches that conventional access logs rarely express.

Intent must not become an alibi

Recorded intent can be abused. A vague objective such as “complete the project” can justify almost any later action if investigators treat it generously. A malicious operator can write a benign task description while granting dangerous capability. An agent can claim that an unexpected action served the goal. The intent record is evidence, not exoneration.

That is why mandate and capability must be compared. If the objective was narrow but the credential was broad, the architecture created unnecessary exposure. If both were broad, the approval process deserves scrutiny. If the capability was narrow and the agent found a path around it, the enforcement failed. The joined record assigns the right question to the right layer.

Intent should also be versioned. Tasks evolve during execution. A person may expand the scope, change the target, or approve an exception. Overwriting the original objective erases the moment when authority changed. The log should show a chain of amendments, each linked to the actor and evidence that justified it.

Privacy remains important. Prompts and documents can contain secrets that do not belong in a security lake. The system can preserve a bounded task statement, classifications, stable references, and cryptographic commitments while storing sensitive content separately under tighter access. Investigators need enough context to test legitimacy, not a second uncontrolled copy of every input.

Build alerts from expected boundaries

The most useful alerts arise from explicit expectations: a read-only task attempted a write; a local task contacted an external host; an agent crossed from preparation into publication; a new tool appeared after approval; a downstream agent received broader authority than its parent. These signals are explainable because they point to the violated boundary.

Response improves too. The system can pause the specific mandate, revoke its derived credentials, preserve the related evidence, and ask for a focused decision. It does not have to disable every agent or drown the analyst in unrelated events. Intent gives containment the same task-shaped precision that it gives detection.

Afterward, the organization can evaluate more than whether an incident occurred. It can ask whether the mandate was clear, the interface communicated the boundary, the policy enforced it, the agent recognized denial, and the monitor detected departure quickly. Those findings produce design corrections rather than a generic instruction to be more careful.

There is a further benefit during ordinary operations. Intent-aware records make benign behavior easier to clear. Analysts can see that a large read matched an approved indexing task or that an unusual destination belonged to a named research mandate. Better context reduces noisy escalation, which preserves scarce attention for events that genuinely departed from purpose. Precision and accountability reinforce each other.

The organization should periodically sample completed tasks and compare their recorded intent with actual effects. This catches mandates that are consistently too broad, fields that operators fill mechanically, and workflows whose real consequence no longer matches their description. A logging schema can remain syntactically complete while its meaning decays; sampling keeps the semantic layer honest.

An action log is indispensable. It becomes a security record only when actions can be compared with authorized purpose. Agents make intent operationally variable, so the log must carry the variation. Record the job the system was meant to do. Then the verbs can finally tell a story.

— Dispatches · Summit Cognitive