Incidents
Contain, investigate, prove, restore.
An incident is a policy violation that needs attention. Each one shows its severity, the agent, the policy and what happened. Contain it (for example by stopping the agent), investigate the calls behind it, and export the record for your review.