# AUD-001: Keep a configurable record of each conversation


- Area: Audit & Evidence

- Verification: Walkthrough
- OWASP adoption tier: Tier-independent
- Formerly: GOV-014
- URL: /r/AUD-001

**Acceptance criteria:** Record the prompts, responses, uploaded files and tool calls that make up each conversation, with content capture set per policy: full, partial, metadata-only or none, in line with privacy and retention rules.

**Why it matters:** The conversation, not the single prompt, is the unit an investigator or auditor needs to see.

**How to verify:** Show one pilot conversation's record at full, partial and metadata-only capture settings.

**OWASP adoption context:** Logging-depth choices apply across adoption tiers, balancing needed evidence against data minimization and any applicable retention rule.

**Mappings:**
- NIST CSF 2.0: PR.PS-04; ISO 42001: A.6.2.8; SOC 2: CC7.2, P3.1, P4.2 — Selectable prompt/response capture provides AI/security logging evidence while letting privacy and retention policy constrain content depth. The buyer must test that each chosen mode preserves needed event metadata; capture configuration alone establishes neither log integrity nor an adequate monitoring and retention process.
SOC 2: P3.1/P4.2 require the Privacy category and relevant information in scope.
- NIST AI RMF: MEASURE 2.8 — Choosing and documenting content depth can supply evidence for evaluating transparency and accountability alongside privacy trade-offs. A configuration option alone does not establish the evaluation or its adequacy.
- ISO 27001: A.8.15, A.5.34 — Configurable prompt and response capture supports logging design and privacy minimization. Preserve needed event metadata, usable attribution and appropriate retention, protection and analysis even when content capture is disabled. Capture-depth options alone establish neither log integrity, record protection nor lawful monitoring.