honest question: how are you actually handling agent auditability in production?

Genuinely stuck on this and looking for real answers. We are deploying agents across a few internal workflows. The thing that keeps coming up in reviews is what happens 6 months later when someone asks what a specific agent did and why at a specific point in time. A proper audit trail for an agent should include agent version, what it saw, what it reasoned over, what it output and who had access. That is a completely different thing from application logging. Yesterday I came across lyzr(dot)ai while going down this rabbit hole. they have something called Sovereign AI built specifically around this, agent execution traces, version history, access controls, all running inside your own environment with zero external calls (as they claim). First thing I have seen that addresses the audit problem at the architecture level rather than patching it on top. What does your actual production audit setup look like? Would love to hear what people have built Vs what vendors claim