Missing or Incomplete Action Logs

Missing or incomplete action logs occur when the records needed to reconstruct synthetic subject activity are absent, partial, fragmented, or not retained long enough for investigation. This may include missing prompts, responses, retrieved context, tool-call arguments, tool results, non-human identity records, runtime traces, or downstream action identifiers.

This condition frustrates investigation because a synthetic subject action often spans multiple systems. Investigators may see a record change, outbound request, message, command, or file write without the corresponding prompt, context, tool call, or model output that caused it.

The primary risk is evidentiary incompleteness. Without complete action logs, investigators may be unable to determine what the synthetic subject was asked, what information it used, which tool it selected, what arguments it passed, what result it received, or why a downstream side effect occurred.

A related risk is retention failure. Short-lived runtime traces, vendor-managed logs, local developer sessions, temporary files, or uncollected tool outputs may disappear before an incident is recognized. This can leave only partial application logs or the synthetic subject’s own explanation, neither of which should be treated as sufficient evidence.

Investigators should review prompt logs, response logs, retrieval logs, tool-call records, runtime traces, non-human identity events, downstream audit logs, retention settings, vendor telemetry availability, and log ingestion status. Particular attention should be given to missing tool arguments, absent results, incomplete retrieval provenance, missing requester identity, short retention periods, and evidence sources that were not collected into the central logging system.

Investigative Relevance

Missing or incomplete action logs are relevant because investigators cannot reliably explain, attribute, scope, or contain synthetic subject behavior without a complete action trail. The absence of logs may be as significant as the content of the logs that remain.

This sub-section is especially relevant where synthetic subjects call tools directly, use local runtimes, operate through vendor platforms, invoke Model Context Protocol (MCP) servers, generate files, execute commands, or act across systems whose logs are not centrally correlated.