Anyone else struggling with AI auditability?

An agent approved a discount override last month that was technically within policy but bigger than anyone expected. Legal's ask was simple, show the decision chain, what rule allowed it, what version of the policy was live, what the agent had access to when it decided. We had a log of the action itself, but nothing tying it back to which policy version was active or who last changed that rule. We could prove the action happened. We could not reconstruct why it was allowed to happen. That's a different kind of gap than a security incident, it's an auditability problem, and it's fine until someone with real authority asks for the paper trail. We're mapping out what a real chain should look like, tying actions back to the policy that authorized them. For anyone who's built this for agent decisions, where does that trail actually live, and how far back do you keep it?