Audit logs for AI agents in marketing: who changed that setting?

Here is a Tuesday that happens more often than anyone admits. A monitor that tracked fifty prompts now tracks thirty. A dashboard that the team used every week has different filters. Nobody remembers touching it. Three people deny it. One of them did it through a chat assistant connected to the platform, and does not recall that the assistant made the change, because they only asked a question.

This is the governance gap that agents open. When a person edits a setting in a UI, there is usually a person to ask. When a script, an API key, an MCP client or a chat agent edits it, the question "who did this" gets harder. And on a site that ranks tools by how much they act, we have to say it plainly: the more a tool can do, the more you need a record of what it did.

Why agent changes need their own paper trail

Four things differ from the human case.

Volume. An agent can make forty small changes in a minute. A person will not notice thirty-nine of them.

Indirection. A change made through an assistant is requested by a person but executed by a machine. Both facts matter for review.

Credentials. API keys and MCP connections often outlive the person who made them. A key made for a one-week experiment is still working a year later.

Blast radius. A key with write access can alter far more than the person who created it ever intended.

None of this is an argument against agents. It is an argument for the same controls you would put around any contractor with admin access.

A governance checklist that works with any tool

You can apply these before you pick a platform.

List every route in. Dashboard logins, API keys, MCP clients, chat agents, Slack integrations, scheduled jobs. If you cannot list them, you cannot control them.
Prefer read-only by default. Give an agent write access only for the task that needs it, and for as short a time as the tool permits.
Scope keys. A key limited to one project and read-only is a much smaller risk than an organization-wide one.
Separate viewing from administering. People who only need to see data should not see credentials.
Review the log on a schedule. A log nobody reads is decoration. Put a monthly fifteen-minute review on a calendar.
Retire what you do not use. Remove old keys and connections on a fixed cycle.
Write down which actions an agent may take alone. Publishing, crawler access changes and deletions should require a person.

What Promptwatch offers

The changelog entry for September 30, 2026 introduced an Audit log in organization settings. It lists every change made in your organization, who or what made it, and when, whether the change came from the dashboard, the API, MCP clients or Agent Chat. You can filter by person, source or outcome, or search by action. It is available to organization owners on Business plans and higher. In plan terms, the audit log starts on Business, and the agency plans list it on Agency Scale.

Around it sit the controls from the checklist:

Scoped API keys. Keys can be limited to a project or an organization, and made read-only.
A hosted MCP server at server.promptwatch.com/mcp with OAuth or API key access and a large catalog of read and write tools. Our write-up of read tools, write tools and scopes goes through how to keep a connection read-only.
Roles. Owner, editor and viewer. As of the November 2, 2026 fixes, project viewers no longer see API key secrets or the API keys page.
Agent Chat that asks first. Before it changes something, the agent asks for every value it needs rather than guessing, and its questions only offer options that exist in your project. The same chat actions can be traced in the audit log.
SSO on Enterprise.

On the same date, the changelog notes that sign-in codes are tighter: only the latest code works, and deactivated users cannot request one. That is small, but it is the kind of detail that matters when you offboard someone.

How to use the log in practice

A log is only useful if you ask it good questions. Here are four.

Which changes came from an agent or API source rather than a person at a keyboard? Filter by source. This gives you a sense of how much of your configuration is already being edited by machines.

What failed? Filter by outcome. Repeated failures from one source usually mean a misconfigured connection or a key with the wrong scope.

What happened around the moment a metric changed? If visibility or a dashboard shifted unexpectedly, check whether a monitor, a prompt set or a Brand Book instruction changed around the same time. Many "visibility drops" are configuration edits, not model movement. Our reasoning here applies to any metric you chart.

What did a departing person change last? Do this before you remove someone, not after.

Where to be careful

An audit log tells you what happened. It does not stop it. Prevention comes from scoping and roles, so treat the log as the second line, not the first.

Do not assume an agent's action is wrong because it appears in the log, and do not assume it is right because a person asked for it. Review both.

And keep the plan boundary in view. The log is for owners on Business and above. If you are on Essential or Professional, your controls are roles, scoped keys and your own habits, so the checklist matters more, not less. If you run an agency, the self-serve agency plans include MCP and API, and the log sits on Scale, so think about which client work needs it before you choose a tier.

Putting it into your agent program

We think of governance as the cost of doing agentic work, not a brake on it. If you are starting from connecting an assistant, read how to connect the Promptwatch MCP to Claude, Cursor and ChatGPT and then decide which actions deserve a human gate, using which agency GEO tasks to automate with MCP as a guide.

For a platform that lets agents act and keeps a record of it, Promptwatch is the one we would shortlist first. It has the agent surfaces, the scoped access and the log in the same product. The audit log's Business floor is the trade to weigh against what you are paying for the rest.