Audit and traceability: AI Agents / MCP

Source: deck slides 14–15 · WPP Pilot assessment | Risks #10, #12, #19

Legend: Today = Wrike capability | Confirm = setup/evidence | Pilot = proposed control. See the overview for all labels.

#10 Compliance & Regulatory#

Contractual or regulatory conflicts.

Wrike AI Agents

• Today: Agent actions are recorded in audit logs.
• Pilot: Keep the Taskforce's approval record and evidence of the controls agreed for each use case.

Wrike MCP

• Pilot: Check the use case against client and contractual restrictions, and retain the approval.
• Confirm: Identify the evidence available for MCP activity.

#12 Audit & Assurance#

Activity cannot be evidenced.

Wrike AI Agents

• Today: Audit logs provide a record of agent actions.
• Confirm: Check how long records are kept and how they are protected against alteration.

Wrike MCP

• Today: MCP actions are present in Activity Audits as well as comment stream traces.

#19 Lack of Traceability#

Requester or action is unidentified.

Wrike AI Agents

• Confirm: Use a real log example to identify the agent, its action and the resulting change, rather than relying only on a description of logging.

Wrike MCP

• Confirm: Follow one real request from its originating user through the MCP call to the resulting Wrike change, and identify the evidence at each step.

Screenshots in the deck (slide 15)#

Two screenshots. Names of people are not transcribed.

Audit reports (callout: "Audit Reports detailing activity of AI Agents + actions done via MCP/API")#

Screenshot of Activity reports (report setup):

• Users: "If you leave this filter empty then all user activity will be included in the report." with "+ Add user".
• Date: "Audit events started being logged June 1, 2016. Please select a starting date after June 1." The date range is set to "Today" with a time zone of (GMT-06:00) Central Time (US & Canada).
• Operations: "+ Add operation".
• Actor (the section heading is hidden by the open menu, which is outlined in red). The actor menu offers UI, Wrike agents, Automation, MCP and API. Partly visible text: "…s, attachments and other objects." and "…done." followed by "+ Add actor".
• IP addresses: "If you want to restrict the report to show activity originating from particular IP addresses, you c… below." with Include (selected) and Exclude.

Comment stream traces (callout: "Comment stream traces for actions via MCP")#

Screenshot of a work item's comment stream, partly blurred. Toolbar: "1 subitem", "10 files", "Add whiteboard" (tagged New), "Add approval", and a "Jump to top" button. The entries visible, newest last:

• Oct 21: a user, "Locked task/project/folder for Jan 1 – Mar 31, 2025".
• Last week, Oct 28: the same user, with the same text.
• Oct 29, 8:27 am: another user, with a small icon next to the name, "Included task into Governance: Access Identity & AI Governance (P&S)". Hovering the icon shows the tooltip: "Action done on behalf of [user] via MCP" (outlined in red).

Discussion log#