Lesson 4 of 6
The audit trail: linking sessions, objects, transports and reviews
8 min
Listen to this lesson
A year after go-live, an auditor picks a change to the core agreement app and asks: who made it, what were they trying to do, who checked it, and how did it reach production? For agent-made changes, add one more question: which agent session produced it, and what did that session do? This lesson builds the chain of records that answers all five in minutes, using records your systems already keep plus a small amount of glue.
The records
| Record | System | What it proves |
|---|---|---|
| Change ticket | SAP Cloud ALM (S/4HANA program) or ChaRM in Solution Manager (legacy ECC) | Why the change was requested and approved |
| Transport request and object list | CTS in CMD (request CMD K number) | Which objects changed, and which user owns the tasks |
| Version history | CMD repository | Each object version and the user who saved it (KENJI_AGT vs KENJI) |
| Agent tool-call log | Hook log and OpenTelemetry events, shipped centrally | Which session called which tool with which input, and when |
| Review record | Pull request (git) or diff review sign-off | Who read the diff and approved it |
| Check results | ATC and ABAP Unit, attached to the review | That quality gates passed at the reviewed state |
| Import logs | STMS in CMQ and CMP | When the request moved, and who imported it |
| Test sign-off | SAP Cloud ALM test management | That the business process passed |
| Security Audit Log | CMD (filter on *_AGT users) | Logons and security-relevant events of agent users |
Records that together form the audit trail for an agent-made change.
Capturing the agent side
Claude Code can export OpenTelemetry metrics and events when CLAUDE_CODE_ENABLE_TELEMETRY=1 and an exporter is configured. Events include claude_code.user_prompt, claude_code.tool_decision and claude_code.tool_result, and carry standard attributes such as session.id and the user's account identifiers. Prompt text is redacted unless OTEL_LOG_USER_PROMPTS=1, and tool parameters are left out unless OTEL_LOG_TOOL_DETAILS=1. Administrators can set these variables in managed settings, and Claude Code ignores OpenTelemetry exporter variables in a repository's own settings files, so a project can't redirect telemetry.
Turning on tool details and prompt logging makes the trail complete, and also puts code and possibly business data into your log store. Nadia's compromise: tool details on for ADT MCP tools (object names, transport numbers), prompt text off, and the managed hook from lesson 3 writing a compact record of each ADT call. Logs go to the central store with the same retention as transport logs.
One caution about completeness: agent-side logs are only as reliable as the machine that writes them. A developer with administrator rights on the laptop can change local files. That's another reason the SAP-side records (version history under the agent user, Security Audit Log entries, transport logs) carry more weight in an audit than any client-side log, and why the hook ships records off the laptop promptly.
- Session startsClaude Code assigns a session id; the hook records developer, agent user and CMD project
- Tool callsEach ADT MCP call is logged with session id, tool name, object or request, timestamp
- Request linkThe developer puts the session id in the review template; the hook log already holds the request number
- ReviewReviewer approves the diff; the review record holds request, session id and checks
- Ship logsHook logs and OpenTelemetry events go to the central store, retained like transport logs
The SAP side of the trail
- Security Audit Log. Configure a filter in RSAU_CONFIG for users matching *_AGT with the event classes Nadia chose (logon, RFC and transaction starts, user master changes) and evaluate it with RSAU_READ_LOG. Filtering on agent users keeps the volume manageable.
- Version history. Because agent users are separate, each object version shows whether KENJI or KENJI_AGT saved it, without any agent-side log.
- Transport logs. Task owner, release and import logs show the human steps around the agent's work.
- Unified diff. The
abap_transport_get_unified_diffoutput or the pull request diff, stored with the review, shows exactly what was approved.
- 09:02Session a1f3 startsKenji, agent user KENJI_AGT, CMD agent project
- 09:05abap_run_atcPackage ZCMC_CORE_AGREEMENT, logged by hook
- 09:20Objects changedBehavior pool saved by KENJI_AGT, task in CMDK900417
- 10:10Diff reviewedTwo approvals; session a1f3 named in the review
- Next dayReleased and importedKenji releases; Luis imports to CMQ; STMS log
- The transport request is the hub: ticket, object versions, agent session, review, imports and tests link to it.
- Claude Code's OpenTelemetry events carry session.id; prompt text and tool details are off by default and set by admins.
- Separate agent users make SAP version history and the Security Audit Log tell agent from human.
- Test the trail monthly with a random request; gaps are findings.
Check your understanding · not graded
Lesson check
1. Which variable must be set for Claude Code to export OpenTelemetry data?
2. By default, what happens to prompt text in Claude Code's user_prompt events?
3. Which transaction configures Security Audit Log filters, for example for *_AGT users?
4. Which record links all others in Contoso's trace model?