Replay the event journal up to the moment of the decision. Every change to the agent state was appended as it happened, so replaying the events before that point rebuilds the state the agent held.
The reconstruction is exact. A log of what the model returned records the output, and the state that produced it has to be inferred.
Most systems answer this question from application logs. The logs contain what the agent said and sometimes what it was asked, written at whatever level of detail the engineer chose while building the feature. Reconstructing the state behind a decision from that material is inference.
An event journal is different in kind. Each change to the state is appended in order, so the sequence is the state. Replaying it to any point produces exactly what the agent held at that point, including the parts nobody thought to log.
Observability tools sample by design, because retaining every trace at full detail costs more than the signal is worth for performance work. Sampling is the correct trade for latency graphs and the wrong one for an audit, because the interaction an auditor asks about is the one that was dropped.
A journal captures every interaction, and the same capture serves replay testing, conformance checks, drift detection and evidence export.
The journal is append-only and compresses well, and retention is set per category against the regulatory floor that applies. Storage is cheaper than the sampled trace that turns out to be missing.
Events are hash-chained, so a change to an earlier entry breaks the chain and is detectable. The record an auditor reads is the record the runtime wrote.
An audit table records what changed in the database. The journal records what changed in the agent, including the reasoning steps and tool results that never reach a table.
Sanitizers redact and mask before the event is written. Retention categories carry their own floors, so the journal holds what the obligation set permits.
