A business requires evidence of which agent tool changed a record and which user authorized it. What should auditing capture?

1. Raw credentials as the main audit evidence
2. Correlated action records, tool calls, identities, approvals, and relevant provenance without leaking secrets
3. Only the agent's welcome message
4. Only the model's display color