Every Action Is an Event: The Audit Model

Audit trails in most enterprise systems share the same origin story: a bug surfaces, a compliance team asks a question nobody can answer, and an engineer adds logging. The result is a record built around what someone thought was worth capturing at the time they thought to capture it.

This is tolerable when the work is deterministic and the actors are human. It is not tolerable when AI agents are taking actions autonomously and the question "who decided this, and why?" could be asked by a regulator on any day.

Ontoz approaches auditability differently: the event record is not attached to the work. It is the work.

Actions as events, by construction

The process model in Ontoz is a hierarchy: Flow > Stage > Activity > Task > Action. The Action level — Submit, Approve, Reject, Request Clarification, any transition in any workflow — is not just a UI button or a state machine trigger. Each Action is a construct that dispatches a typed event when it fires.

There is no execution path in the system where an action occurs without a record. It is not a matter of whether logging is enabled or whether the developer remembered to instrument the call site. The record is the mechanism. The action and the event are the same thing.

What the event carries

An action event is a structured record, not a log line. It contains:

• Who acted — the person or AI agent, identified by role and session
• What task — the specific task in the flow at that moment
• What action — the specific action taken and the mutations it triggered
• What changed — a diff of data state before and after
• When — precise timestamp
• What was recommended vs what was done — if an AI agent produced a recommendation and a human overrode it, both are in the record

That last point is the one that matters most in agentic contexts. The new audit questions are not just "what happened" but "who made this call, human or AI?" and "did the human agree with the recommendation?" These require a work diff model, not a log model. Ontoz makes this native to every action.

One event stream for humans and AI alike

When an Agentic Task takes an action, it dispatches the same Action construct a human task would. The event carries the same fields; the audit trail shows the same structure. There is no separate AI log to correlate — there is one sequence of actions, with full attribution for each step, whether that step was taken by a relationship manager or an agent running an overnight verification job.

Governance that treats AI actions as a special category requiring separate instrumentation will always lag behind deployment. Governance that bakes attribution into the construct handles human and AI work the same way from the first day of production.

The reporting consequence

Because every action is an event, reporting is not a reporting problem — it is a query problem. Every metric a business head, a risk team, or an auditor might want is derivable from the same event stream, without custom instrumentation.

Turnaround time at each stage: difference between event timestamps. Deviation rates: count of actions that diverged from the rule engine recommendation. AI accuracy over time: extracted value versus human override, event by event.

These are not bespoke dashboards built for a specific review. They are views over a single, consistent event model that the platform maintains automatically.

The system describes itself, by design.