AI Audit Logs Are Security Theater (Until They're Not)

I integrated Claude into an ERPNext workflow last year. The client wanted AI-powered invoice processing with full audit trails. Looked straightforward — log the input, the model call, the output, add a human approval checkbox. Ship it.

Six months in, a payment got routed to the wrong vendor. The audit log was perfect. Timestamps, model version, input data, output decision, approval signature. Every checkbox ticked. Compliance team loved it.

One problem: the AI was hallucinating vendor names that didn't exist in the database, and the "human approval" was someone clicking through 200 invoices a day without actually reading them.

That's when I realized: we were logging the process, not the reasoning.

Here's what changed:

1. Confidence scores matter more than approvals. If Claude returns a vendor match with 67% confidence, that's different from 94%. We now flag low-confidence decisions for manual review, not just any decision. The log shows the threshold, not just "approved."

2. Log the alternatives. When the AI picks option A, what were B and C? Why didn't they win? This takes 2KB more storage but catches hallucinations immediately.

3. Batch check actual outcomes. Every week, we audit what actually happened — did that vendor we matched actually receive correct payments? Our logs now include a "validation_result" field populated 30 days post-transaction. This is where real audit trails live.

4. Make reversibility obvious. Can you rerun the same input and get the same output? We log the exact prompt, temperature, and model hash. If you can't reproduce it, your log is worthless.

The article's right: most teams ship logs that look auditable while proving nothing. I see it constantly in ERP implementations where AI touches financial data.

Your compliance checklist wants checkboxes. Your actual liability needs proof of correctness. Those are different things.

Start logging the reasoning, not just the decision.