> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.1-the-audit-gap-what-you-can-and-cant-see.md). # 6.1 The audit gap: what you can and can't see Every AI platform has blind spots, and knowing exactly what each platform’s logs miss is the difference between a real control and an assumption. *Last reviewed: August 18, 2026* {% hint style="info" %} Every AI platform has blind spots. A control is only real when you know what evidence proves it and what the logs miss. {% endhint %} ## The audit gap: what security teams need to know Audit coverage varies by product surface. Chat, API, coding agent, browser automation, desktop control, connectors, and hosted agents can all produce different evidence. Security teams should document what each log can answer. During an incident, vague audit expectations cost time. ## Common the audit gap security failures * The platform logs chat but not API-key automation. * A connector action appears in the SaaS log but not the AI log. * Desktop actions have endpoint evidence but no prompt context. * Compliance exports exclude a newer agent surface. * Retention windows expire before investigation. ## The audit gap security controls checklist * Create a surface-to-evidence map for each approved AI workflow. * Record what each log can and cannot answer. * Export critical logs beyond the vendor retention window where permitted. * Test audit coverage with pilot users before expansion. * Do not approve regulated workflows where required evidence is unavailable. ## Anthropic ### Overview Anthropic audit evidence splits by surface. The Claude for Enterprise Compliance API covers supported workspace chat activity, but Anthropic states that Cowork activity is not currently included in audit logs, the Compliance API, or data exports. Team and Enterprise customers can stream Cowork activity through OpenTelemetry instead. That stream can include prompts, tool and MCP calls, file paths, skills, plugin use, approvals, and errors, so it needs restricted storage and redaction. Claude's Microsoft 365 add-ins are also outside the Compliance API and data exports; their separate Office-agent OpenTelemetry feed is the main vendor telemetry path. Claude Code cloud execution runs in isolated VMs with scoped credentials and audit logging, while local Claude Code depends on OpenTelemetry and endpoint evidence configured in advance. Cowork also has two execution paths: remote sessions run in temporary Anthropic-managed sandboxes, while local files, apps, browser use, and computer use depend on the desktop. Endpoint detection tools cannot inspect the remote sandbox. Claude in Chrome actions still need target-system, browser, and endpoint evidence. Claude Tag has its own Audit view for scheduled work, saved memory, and optional hourly Agent Proxy network-event exports. Git and MCP traffic are not included in that network export, and the view does not provide a per-action record of every task and requester. Investigators still need the Slack thread, the dedicated service account's actions, and audit logs from each connected system. ### Anthropic documentation * [Claude Code authentication](https://code.claude.com/docs/en/team) * [Claude Code security](https://code.claude.com/docs/en/security) * [Claude Code monitoring](https://code.claude.com/docs/en/monitoring-usage) * [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview) * [Claude in Chrome permissions guide](https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide) * [Claude Cowork architecture overview](https://support.claude.com/en/articles/14479288-claude-cowork-architecture-overview) * [Monitor Claude Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry) * [Work across Microsoft 365 apps with Claude](https://support.claude.com/en/articles/13892150-work-across-microsoft-365-apps) * [Access the Compliance API](https://support.claude.com/en/articles/13015708-access-the-compliance-api) * [Access audit logs](https://support.claude.com/en/articles/9970975-access-audit-logs) * [Review what Claude Tag has done](https://claude.com/docs/claude-tag/admins/audit) ### Applicable Harmonic guides for Anthropic * [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide) ## OpenAI ### Overview OpenAI audit evidence follows the surface and authentication path. OpenAI's Work Admin FAQ says the Compliance API covers user messages and responses across Chat, Work, and Codex. It does not record Work files, actions, or tool calls. OpenAI's separate Compliance Logs Platform keeps 30 days of logs and also does not track files, actions, or tool calls. The Codex Compliance API covers ChatGPT-authenticated Codex use only; API-key-authenticated automation follows API organization settings instead. Work now runs in two materially different places. Work on the web and mobile runs in OpenAI's cloud, while Work in ChatGPT Desktop (Work / Codex) can operate on local files and apps under local Codex permissions and managed configuration. Local endpoint, filesystem, and downstream application logs remain necessary. ChatGPT Atlas is scheduled to retire on August 9, 2026, so treat its missing compliance feed as a migration issue rather than a durable control pattern. Retention still adds a clock to every gap, and the ChatGPT workspace and API Platform remain separate control planes. ### OpenAI documentation * [Compliance APIs for Enterprise Customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers) * [Codex governance](https://developers.openai.com/codex/enterprise/governance) * [Chat and File Retention Policies in ChatGPT](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt) * [Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) * [ChatGPT release notes](https://help.openai.com/en/articles/6825453-chatgpt-release-notes) ### Applicable Harmonic guides for OpenAI * [Securing ChatGPT Enterprise Guide](https://www.harmonic.security/resources/securing-chatgpt-enterprise-guide) * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about the audit gap ### What is the AI audit gap? It is the difference between what a team assumes it can see and what platform, endpoint, connector, and SIEM logs actually record. Concrete examples exist today: Cowork is outside Anthropic's Compliance API, OpenAI Work compliance records omit files and tool calls, and API-key-authenticated Codex activity does not appear in Codex Compliance API exports. Map these gaps before rollout. ### Which AI surfaces have different audit evidence? Chat, API, coding agents, browser agents, desktop control, connectors, scheduled tasks, and hosted agents can all differ. Even within one vendor the paths diverge: Claude Code cloud execution has audit logging while local runs depend on OpenTelemetry configuration, and ChatGPT workspace activity and API Platform usage sit on separate control planes. Map each surface separately rather than assuming one export covers the product family. ### What should an audit map include? For each surface, record the log source, key fields, retention window, owner, export path, known blind spots, and the investigation questions the source can answer. Note plan requirements too, since features like the ChatGPT Enterprise Compliance API are gated by plan. Keep the map versioned, because vendor releases change coverage. ### Can compliance APIs replace SIEM telemetry? No. Compliance APIs are one evidence source with documented exclusions. Cowork and Claude's Office agents need OpenTelemetry, OpenAI Work compliance records omit files, actions, and tool calls, and API-key Codex activity is missing from Codex exports. Runtime telemetry, endpoint logs, connector logs, and SaaS audit trails answer questions that conversation exports cannot, such as what a tool changed downstream. ### When should a workflow be blocked for audit reasons? Block or defer a workflow when required evidence for regulated data, write actions, or incident response is unavailable and no compensating control exists. A browser surface with no compliance feed handling regulated data is the canonical example. Record the gap, the decision, and the condition that would unblock it. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.2 EU AI Act obligations for deployers | Conditional: for an in-scope high-risk system, this supports logging coverage, known gaps, and evidence availability. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports monitoring, investigation, audit evidence, and incident reporting. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Monitoring and GRC guidance. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.7 Ownership and RACI for AI security | This control depends on the ownership and evidence responsibilities defined in the RACI. | | G.8 ISO/IEC 42001 AI management system | This article supports ISO/IEC 42001 AIMS preparation through documented monitoring and audit gaps. | | G.9 HIPAA controls for AI systems handling PHI | Conditional: for a workflow handling ePHI, this supports HIPAA audit controls, activity review, and investigation evidence. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [6. Observability, Audit & Evidence](/handbook/6.-observability-audit-and-evidence.md) * [6.2 OpenTelemetry for AI runtime visibility](/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md) * [6.3 Compliance APIs by platform](/handbook/6.-observability-audit-and-evidence/6.3-compliance-apis-by-platform.md) * [6.4 Analytics and usage APIs](/handbook/6.-observability-audit-and-evidence/6.4-analytics-and-usage-apis.md) * [6.6 Evidence by surface and investigation paths](/handbook/6.-observability-audit-and-evidence/6.6-evidence-by-surface-and-investigation-paths.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.1-the-audit-gap-what-you-can-and-cant-see.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.