How do you know what your AI coding agent actually did? Here's how I learned I didn't
Coding agents now run commands, read files and call tools with our own permissions, and most of us review the final diff rather than every step. For a while that felt fine to me.
Then I started recording every tool call my own agents made. Some of what it flagged in my own sessions was things I hadn't noticed at all, like a credential read followed by a call to a cloud API in the same session. Each turned out to have a reason, but I only knew because I looked. The transcript alone wouldn't have told me.
I'm curious how others approach this:
- Do you review what your agent ran, or only the result? Why?
- Has an agent ever done something you only noticed later, like deleting a file, reading a secret, or installing a package?
- For teams: is there any real record of agent actions, or is it trust plus code review?
- Where's the line between useful visibility and noise you'd ignore?
I'll share what I've seen in the replies, but I'd rather hear how you handle it first.
Replies
I review the result for most tasks and the steps only when the agent touched something outside the code: env files, credentials, network calls, git push. Reading every step doesn't scale, so I'd rather limit what it can do than review everything it did. Curious what your recorder flags by default, is it a fixed list of sensitive actions or something you tune per project?
I review the diff for code and the transcript for everything that is not code. A diff cannot show a deploy, a secret read or a deleted document, so for those the rule in my notes file is that the agent says afterwards what it did: deployed these functions, registered this token, ran this script. Two classes need a word before, not after: destroying data, and anything that reaches real users, a store build or a deploy during an incident. Everything else it may run, because being asked about every package install would make me stop reading the answers, and then the review is theatre. Has it done something I noticed late? Yes. A bare git commit once took a rename and a deletion another session had staged, and main was unbuildable for one commit. That is how the commit by path rule got into the notes. For a solo developer the record is the git log plus the notes file the agent updates when it learns something. I do not have a tool call log, and I would want one for the deploys and the account level actions, not for the file reads.