{"id":"AUD-001","section":"Audit & Evidence","requirement":"Keep a configurable record of each conversation","acceptance":"Record the prompts, responses, uploaded files and tool calls that make up each conversation, with content capture set per policy: full, partial, metadata-only or none, in line with privacy and retention rules.","tier":"Tier-independent","whyItMatters":"The conversation, not the single prompt, is the unit an investigator or auditor needs to see.","verificationMethod":"W","verificationTest":"Show one pilot conversation's record at full, partial and metadata-only capture settings.","formerly":"GOV-014","alsoIn":["aidr"],"sort":52,"adoptionContext":"Logging-depth choices apply across adoption tiers, balancing needed evidence against data minimization and any applicable retention rule.","mappings":[{"frameworks":["csf","iso","soc2"],"explanation":"Selectable prompt/response capture provides AI/security logging evidence while letting privacy and retention policy constrain content depth. The buyer must test that each chosen mode preserves needed event metadata; capture configuration alone establishes neither log integrity nor an adequate monitoring and retention process.\nSOC 2: P3.1/P4.2 require the Privacy category and relevant information in scope.","kind":"framework","references":{"csf":["PR.PS-04"],"iso":["A.6.2.8"],"soc2":["CC7.2","P3.1","P4.2"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Choosing and documenting content depth can supply evidence for evaluating transparency and accountability alongside privacy trade-offs. A configuration option alone does not establish the evaluation or its adequacy.","kind":"framework","references":{"rmf":["MEASURE 2.8"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Configurable prompt and response capture supports logging design and privacy minimization. Preserve needed event metadata, usable attribution and appropriate retention, protection and analysis even when content capture is disabled. Capture-depth options alone establish neither log integrity, record protection nor lawful monitoring.","kind":"framework","references":{"iso27001":["A.8.15","A.5.34"]},"relation":null,"conditions":[]}],"area":"Audit & Evidence","areaSlug":"AUD","url":"/r/AUD-001","frameworkRefs":{"ISO27001":["A.8.15","A.5.34"],"ISO42001":["A.6.2.8"],"NIST-CSF":["PR.PS-04"],"NIST-AI-RMF":["MEASURE 2.8"],"SOC2":["CC7.2","P3.1","P4.2"]}}