An AI feature you cannot audit is an AI feature you cannot govern. PlanMagnet's answer is structural rather than aspirational: the service has exactly one primitive that every AI capability must route through, and that primitive cannot complete without writing a ledger row.
Each row records the workspace, the acting identity and actor type, what triggered the call, the provider and model that actually served it, token counts in and out, latency in milliseconds, the parsed decision, and a success or failure status. Rows are append-only and indexed by workspace and time, so the history of what the AI did on a workspace is a queryable record rather than a log file someone rotates away.
The failure paths are the part worth reading closely, because they are where honesty is usually lost. If the provider call throws, a row is still written with the error and the latency before the error propagates — the attempt is not invisible just because it did not work. If the provider answers but the response cannot be parsed into valid output, the run is recorded as a provider success with the parse failure captured and no decision attached, and the caller gets an explicit error. There is no path where a malformed model response quietly becomes an empty success or a fabricated result.
On data boundaries, the ledger stores a short non-identifying summary of what was asked rather than the raw prompt text, so an audit trail does not become a second copy of your content. Provider keys are never held in the repository; each adapter resolves its key at call time from the environment, populated from the platform key vault, and a missing key fails loudly as "provider unavailable" rather than degrading into a fabricated answer.
The write path is live in the PlanMagnet service today, with a migration behind it, and the work-item breakdown decision already records through it. What is not built yet is the reading: there is no ledger query exposed through the API and no activity feed in the app, so today the rows accumulate correctly but an admin cannot yet browse them in a UI, and per-workspace cost metering and AI-credit quotas are not wired. Those are committed roadmap, and this story marks them as such rather than implying an audit console exists. This story is narrative-only today; the interactive app walkthrough is not yet available.
Ready to make this your story?
