What does it mean that the perimeter is now a logging boundary?

AI agents operate inside the trust boundary by design. Network controls, IAM, and VPC rules cannot constrain an authorized agent acting on its own credentials. The only boundary that still produces enforceable evidence is the record of what the agent did, under what authorization, and at what timestamp. Whoever owns that record owns the perimeter.

Are application logs and inference traces enough to satisfy 23 NYCRR § 500.6(a)(2)?

Read against the rule, no. As amended by the Second Amendment effective 1 November 2023, § 500.6(a)(2) requires audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal operations of the covered entity. An application log records HTTP method, status, and latency. An inference log records prompt and completion tokens. Neither answers what NPI was accessed, by which agent, under what authorization, and when, at the operation level a forensic investigation needs.

What does regulatory-grade evidence add that observability does not?

A record mapped to a specific EU AI Act obligation binds an agent action to a specific authorization and a specific timestamp, and it is independently verifiable without contacting Warrant. Observability traces are mutable by the operator and prove nothing on their own. A regulator examining a post-incident audit trail needs the second category, not the first.

Warrant. The agent perimeter is not a metaphor anymore.

01 · OLD PERIMETER

The old perimeter (network boundary).

for thirty years, the perimeter meant a network drawing. firewall on the outside, VPC inside, IAM controlling who could cross. the assumption · an attacker comes in over the wire, and the job is to keep them out. inside trusted, outside hostile.

that model held because human operators were the only thing inside that could take consequential actions. humans have HR files, badge logs, manager approvals. the perimeter could afford to be a network drawing because the actors inside it were accountable through other systems.

02 · NEW PERIMETER

The new perimeter (logging boundary).

agents broke the model. an agent that an enterprise authorized last quarter is, by construction, inside the trust boundary. it has credentials. it can call internal APIs. it can read nonpublic data. network controls cannot stop an authorized agent from doing what it has been authorized to do, and IAM cannot tell you whether what it did was within purpose.

so the question security teams now have to answer is not did anything cross the wire but what did the agent do, under what authorization, at what timestamp, and can we prove it after the fact. that is a logging question, not a network question. the boundary that matters is the boundary between actions that produce a durable record, independently verifiable without contacting Warrant, and actions that do not.

the New York Department of Financial Services put the regulator-side version of this in writing on 16 October 2024. the Industry Letter on AI cybersecurity opens with a sentence the rest of the document depends on:

"This Guidance does not impose any new requirements beyond obligations that are in DFS's cybersecurity regulation codified at 23 NYCRR Part 500." NYDFS Industry Letter on Cybersecurity Risks Arising from Artificial Intelligence · 16 October 2024 · Introduction

read that twice. NYDFS did not write a new AI rule. it confirmed the existing rule, in force since 2017 and last amended November 2023, already attaches to AI systems. the audit trail provision inside that rule, 23 NYCRR § 500.6(a)(2), is what does the work:

"include audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal operations of the covered entity." 23 NYCRR § 500.6(a)(2) · Second Amendment · effective 1 November 2023

a sitting US financial regulator, on record, applying an operation-shaped audit trail rule to AI systems handling nonpublic information. the perimeter has moved.

03 · THREE IMPLICATIONS

Three implications for security teams in 2026.

application logs are necessary but not sufficient. gateway logs and APM traces tell you a tool was called and an LLM was invoked. they do not tell you whether the agent had purpose-aligned authorization to take that action against that subject at that moment. the trail § 500.6(a)(2) requires is operation-shaped. APM traces are traffic-shaped. necessary for SRE. not sufficient for the regulator.
the operative perimeter is the audit trail. who can prove it, controls it. access control lists tell you who is allowed to do what. they do not tell you what was done. when an agent has standing authorization to read a customer record, the ACL has already approved every read it will ever make. the only remaining control is a record of each read mapped to a specific obligation, bound to the specific authorization context and independently verifiable without contacting Warrant.
regulators have already crossed this line. NYDFS issued its AI Industry Letter on 16 October 2024, applying 23 NYCRR Part 500 (in force since 2017) to AI systems. The letter is explicit that no new statutory text was needed:
"This Guidance does not impose any new requirements beyond obligations that are in DFS's cybersecurity regulation codified at 23 NYCRR Part 500." NYDFS Industry Letter · 16 October 2024 · Introduction
EU AI Act Article 12 requires automatic recording of events over the lifetime of high-risk AI systems, now applying 2 December 2027 (deferred from 2 August 2026 to 2 December 2027 by the Digital Omnibus, Regulation (EU) 2026/1744, OJ 24 July 2026). SEBI's algo-ID mandate took full effect 1 April 2026. the agent-perimeter shift is codified across jurisdictions on a fixed timeline that does not turn on operator readiness.

04 · OPERATIONAL SHIFTS

What this changes operationally.

three shifts for SOC and compliance teams in the next twelve months.

one. the SOC's agent-incident playbook now needs a forensic-evidence step, not just a containment step. when an agent does something it should not have done, the question regulators will ask is not whether you stopped it but whether you can prove what authorization context was active when it acted. that proof must be producible in days, not in a six-month log-mining exercise.

two. compliance and security have to stop treating audit trails as a logging-team problem. the trail is now the primary control. the team that owns it owns the perimeter. in most enterprises that team does not yet exist as a named function. it will, by the end of 2026.

three. evidence portability matters. a trail that lives only inside one vendor's system is not evidence in the legal sense, because the vendor can mutate it. the trails that survive enforcement scrutiny are the ones a regulator can verify without contacting the operator. that is a record mapped to a specific obligation and independently verifiable, not a query result.

05 · THREE PERIMETERS

Three perimeters that are now logging boundaries.

the framing is not abstract. three sectors have already had their perimeter redrawn by enforcement-shaped rule-making. each one is an example of the same shift · the boundary that used to be the network is now the model-output, the prompt-and-response, or the recommendation API. the instruments named below are in force except where marked draft.

sector ibanking.

SR 26-2 · 23 NYCRR § 500.6(a)(2). model risk management guidance was first written for quantitative models in 2011 (SR 11-7). SR 26-2 (17 April 2026) is the current Fed / OCC / FDIC guidance and supersedes it — and it does differentiate by implementation. footnote 3 to its § II: Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. a chatbot recommending a savings product in 2026 is therefore outside the model risk guidance and inside the bank's own risk management and governance practices, which footnote 3 routes it to. the boundary used to be the LAN · firewall on the outside, core banking on the inside. the boundary is now the model-output boundary — and for the agentic layer the bank sets the record itself and defends it, with supervisory action for unsafe or unsound practices preserved by footnote 1. § 500.6(a)(2) is the clause that still bites on this surface directly.

sector iihealthcare.

HIPAA § 164.312(b) · FDA SaMD guidance · EU AI Act Art. 6(1) + Annex I §A(11). a clinical-decision-support model that suggests a diagnostic code is, under FDA's 2022 final guidance, a software-as-a-medical-device. under the EU AI Act that routes it through Article 6(1) and Annex I, Section A, point 11 — Regulation (EU) 2017/745, the Medical Device Regulation — not through Annex III, and its high-risk rules apply from 2 August 2028 (subject to Article 2(13)) rather than 2 December 2027 (Art. 113, third para, point (c)(ii), as replaced by Reg (EU) 2026/1744 Art. 1(40)(b)). Annex III reaches health only at point 5(a) public-authority benefit eligibility, 5(c) life and health insurance pricing, and 5(d) emergency triage. the boundary used to be the EMR · who could read the chart. the boundary is now the prompt-and-response boundary. every advisory action the model gives a clinician is a recorded interaction. retention follows the most demanding sector the operator touches · MDR Article 10(8) keeps the technical documentation for at least ten years after the last device was placed on the market, at least fifteen for implantable devices.

sector iiicapital markets.

SEBI Retail Algo Framework (in force 1 April 2026) · MAS FEAT. SEBI's circular requires every order originating from a registered algorithm to be tagged with that algorithm's unique algo ID for audit-trail purposes, which puts the identifier on the algo, not on the order-management system that later carries it. the boundary used to be the OMS · what hit the exchange. the boundary is now the recommendation API itself. a broker-dealer running a chatbot that surfaces stock ideas to retail in India operates under a recording obligation that did not apply to that surface six months ago. MAS has proposed the same logic for Singapore in Consultation Paper P017-2025, Proposed Guidelines on Artificial Intelligence Risk Management — a draft, not in force: as at MAS's media release of 20 March 2026 it was still reviewing consultation responses, and no final Guidelines had issued.

read across the three rows · the sectoral statute does not name AI in any of them. SR 11-7 was written in 2011, HIPAA's audit-control provision in 2003, NYDFS Part 500 in 2017, SEBI's algo rules pre-date the current LLM moment. what changed is not the rule. what changed is where the rule attaches now that the regulated output sits at a model boundary.

06 · WHAT WAS ALREADY KNOWN

What was already known but underweighted.

none of what follows is new to anyone who has built audit infrastructure for a regulated industry. five things security architects knew five years ago. the AI-agent moment makes them load-bearing in a way that sectoral compliance teams had not yet had to act on.

logging completeness is harder than logging correctness.you can fake a log line, redact a log line, or add a log line after the fact. you cannot fake a complete record. completeness is what the regulator examines · what was not logged is what the operator cannot defend. the engineering question shifts from "is this log line accurate" to "can the operator demonstrate, at write time, that no qualifying action escaped the trail." the answer is structural · the log emission has to live inside the call boundary, not outside it.
tamper-evidence beats tamper-proofness.a record that is independently verifiable without contacting the operator is what regulators recognise. tamper-proof storage is a marketing claim · tamper-evident is a court-admissible one. the difference matters because no storage is actually proof against the operator with admin credentials, but a record mapped to a specific obligation can be checked by a counterparty and shows as altered if it has been altered. the standard is "could a counterparty independently detect a change" · not "could anyone in the world prevent a change."
distributed tracing semantics become regulatory.the W3C Trace Context spec was written for SRE observability · trace IDs, span IDs, parent-child causality. the same primitives are now what a regulator needs to follow an action across a multi-system agent run. when an agent calls a tool, which calls an LLM, which calls another tool, the regulator wants the same parent-child reconstruction the SRE team uses for latency analysis. the trace context becomes part of the audit record.
the audit boundary moves with the API boundary.every time an agent calls a new external API, the audit boundary moves with it. compliance that was scoped to the operator's data centre now follows the request out to model providers, vector stores, retrieval endpoints, and tool-call surfaces. the operator does not get to decide where the boundary is · the regulator follows the data and the decision-shape, not the operator's network diagram.
retention is sectoral and the floor is set by the most demanding sector.EU AI Act Article 19(1) sets a floor of at least six months for provider-held high-risk system logs, and Article 26(6) the same floor on the deployer side. US bank model risk guidance states no retention period at all — neither SR 11-7 nor SR 26-2 fixes one, so the bank's own record-retention schedule and examination cycle set that horizon. HIPAA § 164.316(b)(2)(i) requires documentation to be retained for 6 years from creation or last effective date, whichever is later. MiFID II Article 16(7) keeps the records it covers for five years, and up to seven where the competent authority requests it. the operator's retention policy is a maximum, not a minimum · the floor is set by the most demanding regime that any single action in the trace touches. an agent that crosses banking and healthcare in one run inherits the longer of the two retention windows for that entire trace.

Authored by Warrant Editorial. [email protected]. Editorial commentary on the structural shift in security perimeters as AI agents enter regulated environments. Not legal advice.