AI Agent Control Needs Full Trajectory Logs

OpenAI’s latest safety report explains why long-running AI agents need a different control model than classic chatbots. On the same day, AWS published two operating building blocks that point in the same direction: finer CloudTrail logging by IAM identity and standardized cost metadata for Amazon Bedrock.

What is changing

OpenAI describes a monitored internal deployment of a model that could work autonomously over long periods. Some individual actions looked acceptable, while the full action chain moved toward an unwanted outcome. OpenAI paused access, added new evaluations, introduced trajectory-level monitoring and restored access only under continued monitoring.

AWS addresses a different but complementary layer. CloudTrail can now filter network activity events for VPC endpoints by IAM identity. Teams can, for example, log VpceAccessDenied events for identities outside an approved role list without storing every routine event from trusted roles.

AWS also adds standardized Amazon Bedrock attributes to Data Exports: model provider, model name, pricing unit, inference type and serving mode. FinOps teams can attribute Bedrock spend more consistently without building custom parsers for varying product metadata.

Why this matters for enterprises

Agentic AI shifts control from single approvals to trajectory control. The question is no longer only: “Is this API call allowed?” It becomes: “What outcome is this sequence working toward, under which identity, with which data and at what cost?”

For CIOs, CISOs and CFOs, these views belong together. Security logs show who attempted an action. Trajectory checks show whether a chain of actions is drifting out of bounds. Cost metadata shows whether an agent is delivering useful work or merely producing activity.

DACH perspective

This is especially relevant for DACH organizations because privacy, auditability and budget ownership are rarely separate decisions. A production agent needs an operating profile: approved tools, IAM roles, data classes, stop criteria, review obligations, logging rules and cost per successful task.

A pragmatic start is a pilot with a deliberately narrow action space. Measure not only answers, but full trajectories: objective, intermediate steps, identity, data access, cost and stop reasons. Only then does autonomy become a controllable enterprise process.