← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Audit log for n8n AI Agent workflows

n8n's AI Agent node (part of the n8n-nodes-langchain package) wraps a model and a set of tool nodes in a LangChain.js agent loop. Every execution is stored in n8n's own database as an "execution" you can inspect in the UI. That is enough for debugging a workflow, but it is not evidence: anyone with database access can edit an execution record, and retention is whatever you configured for execution pruning, often days, not months.

What to record

Every model call the Agent node makes: model, prompt, response, tokens.
Every tool call the agent triggers, including other nodes it invokes (HTTP Request, database queries, sub-workflows).
Which policy, if any, allowed or blocked the call, and why.

Where to hook in

Because the AI Agent node runs LangChain.js internally, the input/output shape at each step matches what the LangChain guide already covers — but n8n's low-code surface does not expose LangChain's callback manager to you directly. Two practical points to record at instead:

In front of the model credential. If you self-host n8n and route model calls through your own proxy or gateway before they reach OpenAI or Anthropic, wrap that client with @vetro/openai's wrapOpenAI or @vetro/anthropic's wrapAnthropic — both are duck-typed and need no n8n-specific integration.
In a custom node. n8n lets you write custom nodes in TypeScript. A small node that logs its own input and output via run.toolCall() / run.toolResult() from @vetro/core, placed around the sensitive steps of a workflow, gets you call-site evidence without touching the Agent node's internals.

Tool nodes are the real risk surface

The nodes an n8n agent can call — HTTP Request, database write, filesystem, sub-workflow — are where damage happens. Treat each as a tool call: log the node's resolved input before it runs and its output after, and check an inline policy (allowed hosts, no destructive SQL, spend caps) before execution, the same tool.deny / budget.* rule types used in the Claude Code hooks guide.

After the fact, if that is all you have

n8n's REST API and the "workflow finished" trigger can export execution data once a run is over. That is weaker evidence than a call-site ledger — it proves what n8n's database says happened, not what happened before anyone could edit it — but it is better than nothing, and it can still be hashed and signed at export time (see tamper-evident logs).

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers. If your retention window is the open question, check it here. For something to hand to an auditor or a customer, Vetro Attest issues a 49 USD counter-signed report mapping the evidence to EU AI Act articles, including a list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.