AI SDR Audit Log: Answer for Every Email an Agent Sends
What to record for each message an outbound agent sends, when to write it down, and the one question from a prospect your log has to answer in a single lookup.
Sooner or later a prospect replies with one line: where did you get my email?
It is a fair question, and usually a polite one. If answering it means an afternoon of digging through a Gmail sent folder and an agent transcript nobody saved, the honest reply goes out on Thursday or never, and a prospect who was half curious decides you are a spammer. With a decent audit log it takes one lookup. The agent found them through a job post for a RevOps lead on October 3, and the email cited that post in its second sentence.
The pages that rank for AI agent audit logging are written for security teams, and they are long. They agree on the core. Capture the trigger and the model version, then every tool call with its inputs and outputs, plus the policy decision that allowed or blocked it. Record human approvals as their own events. Make the log hard to change after the fact. Most of them also give a full section to retention periods. All sound, and the outbound version of each is below.
None of the three we read mention the recipient. In outbound, the person most likely to ask what your agent did is the prospect, and they ask in plain English, in a reply. This page is built around that question. It also pulls together the logging rules scattered across our guide to AI SDR approval queues, our AI SDR exclusion list guide and our AI SDR kill switch page, so they live in one record.
One record per email
Our rule: every message the agent puts in front of a prospect gets one record, keyed to the prospect and the sequence step, and every system that touches the message writes to that same record. Five logs joined later by timestamp never line up on the day you need them.
Why this person
Written at enrollmentThe signal that put them on the list (a funding announcement or a job post, usually) with its URL and the date the agent found it, plus the ICP rule they matched. This is the field that answers the prospect later, so it has to be a link a person can open. A model summary of the link does not count.
The claim
Written at draftThe one fact the email leans on, quoted from the source. If the draft says a company just opened a Denver office, the record holds the sentence on the page that said so.
Who approved it
Written at approvalThe draft as the agent wrote it, the text as it actually went out, the approver by name, and the seconds between the card appearing and the click. Keep both versions. The difference between them is your edit rate.
The checks
Written at sendExclusion and suppression lookups with their real results, plus every pause flag that was checked. Errors and empty answers get recorded as errors. An empty suppression list from an expired token and a genuinely empty one look identical a week later unless somebody wrote down which it was.
Where it went
Written after sendSending mailbox, the tool that delivered it, the message ID that tool returned, and the version of the prompt that wrote the draft.
The prompt version is the field teams forget. Someone adjusts the tone of voice on a Wednesday, reply rates move the following week, and without it nobody can say which emails came from which prompt.
Write it before the send
Order matters here.
Log the intent first and the outcome second. If the send tool times out at 9:02 and the agent retries at 9:07, the retry should find an open record with no message ID on it and go check the thread before doing anything else, which is the cheapest guard against duplicate sends we know of. A record written only after a successful send cannot help with that, because the timeout means it was never written at all.
Answering "where did you get my email?"
Our AI SDR reply handling guide files this under questions, so the agent drafts the answer and a person sends it. The draft should come straight off the record, in two sentences at most: what the agent saw and the date it saw it. "I came across your LinkedIn post about hiring a second SDR on October 3 and guessed outbound was on your mind." Then offer to stop, and mean it.
People who ask this are often more interested than they sound. Mostly they want to know whether a human ever looked at them, and a specific answer tells them faster than any apology could.
If the record cannot produce an answer, you have learned something worse. An email with no source URL behind it is an email the agent could not trace, and it should never have reached an approval card in the first place. The approval queue guide says to fight for the source line on the card. The log is where you find out whether you won that fight.
Deletion requests
When someone asks you to delete their data, delete the research and the drafts but keep their suppressed address with the date they asked, because a log that forgets a person completely lets the agent rediscover them next quarter through a fresh job post (check how that squares with GDPR in your situation; our cold email compliance guide covers the deletion right itself).
What to leave out
OAuth tokens and API keys, which end up in logs more often than anyone admits, because a lot of tooling dumps the full payload of a tool call by default. Scrub them at the tool layer before anything is written.
Whole scraped pages. Keep the URL and the quoted sentence. A full copy of a stranger's About page sitting in your database is something you will eventually have to explain to someone.
Long reasoning transcripts, mostly. The security guides like full decision traces, and for debugging a bad week they help. What a person actually reads is the label and the one-line reason we ask the model for when it classifies a reply. Keep traces on a short clock and the record itself on a long one.
Nobody edits the log
The agent included. It writes through a tool that can append and never update, the same shape as the suppression list in our MCP tool permission matrix: read and add, never remove. A correction is a new line that points at the old one.
Read it on Mondays
Twenty minutes a week is enough. Count skipped sends by rule, since a sudden drop to zero usually means the CRM sync broke. Look at approval times per approver, because a draft with a source link approved two seconds after it appeared was not read. Then pull five sent emails at random and answer "where did you get my email?" for each one from the record alone, without opening Gmail or the CRM. If you cannot do it for all five, fix that before you raise volume.
Why we care
After the free pilot we get paid per qualified meeting, and a qualified meeting is one where the prospect shows up. When a client asks why a particular meeting happened, or why a particular person heard from us more than once, the record is how we answer with something better than a guess. Our sequences run five to eight touches across email and LinkedIn, so one prospect can carry eight records by the time anyone asks.
Mira runs on OpenClaw from a Mac mini in San Francisco, and the log is one more table in a setup somebody maintains. The OpenClaw MCP Integration Kit ($9.99) ships twelve annotated MCP skill configs with a tool permission matrix and an auth troubleshooting runbook, a reasonable place to decide which tools write to the record. For what lands in HubSpot once someone replies, read our AI SDR CRM integration guide. If you would rather someone else kept the log, here is how Mira works.