The audit-trail stack: how buy-side agents are forcing expert networks and transcript vendors to emit WORM-grade event logs

The compliance artifact a buy-side firm retains from a research workflow in 2026 is no longer the transcript. It is the event log underneath the transcript. We read the shift from content-as-record to event-stream-as-record as the single most consequential change in research-vendor procurement this cycle, and the vendors who understand it are being written into enterprise agreements ahead of the vendors who are still shipping PDFs and MP3s.

The regulatory anchor is in place. The buy-side demand is in place. The archive-vendor pipes are in place. What is missing, in most cases, is a research vendor whose product surface treats the per-event log as a first-class deliverable rather than a support-ticket export. That gap is where the next round of RFP wins and losses is being decided.

What the 2022 17a-4 amendment actually changed

For two decades, Rule 17a-4(f) was read by broker-dealer compliance teams as a hardware specification. A regulated electronic record had to live on media that was physically or logically non-rewriteable and non-erasable: optical platters originally, then WORM-sealed object storage, then compliance-managed cloud buckets with retention locks. The record itself (the email, the IM, the research report) had to be the thing sealed.

The SEC's 2022 amendment kept that WORM pathway open and added a second one. A broker-dealer can now satisfy the preservation requirement with an audit-trail alternative: a system that maintains a complete time-stamped record of all modifications, with the original and all subsequent versions preserved and verifiable. The practical effect is that an immutable event log, if it captures the full provenance chain of an artifact, can stand in for sealing every version of the artifact itself.

This is not a loosening of the rule. It is a modernisation of the mechanism. The regulator still wants to see, on demand, exactly what a registered person saw and when they saw it. The amendment acknowledges that in a world where a single research question might touch a dozen upstream data sources through an agent, sealing every intermediate artifact is both operationally impossible and informationally inferior to sealing the event stream that produced them. FINRA Rule 4511 incorporates the 17a-4 framework by reference and extends the same recordkeeping expectation across the FINRA membership.

The knock-on effect for the vendors that supply research inputs to broker-dealers and their affiliated advisers is direct. If the buy-side compliance team is going to rely on an audit-trail record to meet its preservation obligation, the audit trail has to actually exist, has to be complete, and has to be portable into whatever archive the firm has chosen. A vendor that cannot emit a structured record of what the client did inside the vendor's platform is a vendor whose outputs the compliance team cannot defensibly retain under the new pathway.

Why agent runtimes broke the old model

Until roughly 2024, the compliance surface of an expert-network engagement was straightforward. An analyst requested a call, a call happened, a recording was produced, a transcript was produced, and the transcript was emailed or downloaded. The buy-side firm's archive captured the email or the download event, and the transcript itself was retained under whatever retention schedule applied to external research. One artifact in, one artifact sealed.

That model does not describe what happens when an agent runs the workflow. In an agent-driven research session (and we are now seeing these in production inside Rogo deployments, Hebbia workspaces, OpenAI's ChatGPT for Financial Services, and the internal stacks that Bridgewater and several other large allocators have built), a single analyst prompt can produce thousands of discrete events. The agent reads twelve transcript segments across four different calls, rewrites its own prompt three times based on intermediate findings, pulls company fundamentals from S&P Capital IQ, cross-references a PitchBook private-company record, and surfaces a two-paragraph answer with four footnotes. None of those twelve segment reads were a human download. None of them generated a traditional artifact. All of them are, under a strict reading of the recordkeeping rules, potentially regulated research inputs.

The compliance question is no longer did we retain the transcript. The compliance question is can we reconstruct, on demand, which agent identity touched which specific segment of which specific transcript at which specific timestamp, under which human analyst's authorisation. The transcript file sitting in a shared drive answers none of those questions. Only the event log does.

This is why the procurement conversation has shifted. A head of research technology at a multi-strategy fund we spoke to in Q1 2026 framed the issue as a shortlist mechanic: the first filter in the RFP is now whether the vendor can emit a structured per-event feed into the firm's chosen archive, and vendors that fail that filter do not reach the content-quality evaluation at all.

What a WORM-grade event log actually has to contain

The specification is not formally standardised, but the working requirements emerging from buy-side RFPs through 2026 are converging on a consistent shape. In our view the baseline is roughly:

• Actor identity, resolved through federated SSO and SCIM so that the actor is traceable to a specific human user or a specific agent service principal, not a shared account.
• Action, typed and enumerated: transcript.segment.read, expert.profile.view, call.request.submit, agent.prompt.rewrite, tool.call.external, with a stable schema so the archive can index on action type.
• Target, resolved to a persistent identifier for the artifact and, where applicable, the sub-artifact (segment, timestamp range, speaker turn).
• Timestamp, in UTC with sub-second precision, from a clock the vendor can attest to.
• Authorisation context, including the human analyst on whose behalf an agent is acting, the entitlement that permitted the action, and the compliance policy version in effect at the time.
• Content hash, a cryptographic digest of the artifact as served, so that if the underlying transcript is later edited or redacted, the archive can prove what was actually seen at the moment of the action.
• Chain-of-custody metadata, linking the event to the upstream request that triggered it and the downstream event that consumed it, so that an agent trajectory can be reconstructed end to end.

The emphasis on content hashing is where this connects to the transcript-provenance work INFLXD has covered previously. A log that records a segment read without binding that read to the content hash of the segment as it existed at that moment is a log that can be invalidated by any later edit upstream. The log and the signed artifact are complementary; neither works on its own.

The archive layer is already waiting

The downstream pipes exist. Global Relay, Smarsh, and Theta Lake have spent the last three years positioning for exactly this ingestion pattern, with structured event-feed connectors, WORM-locked object storage on the back end, and surveillance tooling that can run lexicon and policy checks against the event stream rather than only against finished documents. Global Relay in particular has been explicit in its post-amendment guidance that the audit-trail pathway shifts work from the content-capture layer to the event-capture layer, and that the archive is the natural place for that event stream to land.

What the archive vendors cannot do is manufacture the events. If a research vendor's platform does not emit a structured record of what happened inside it, the archive has nothing to seal. This is the operational asymmetry that is reshaping research-vendor procurement. The archive layer is ready. The buy-side demand is ready. The regulation is ready. The bottleneck is the content-vendor side, and specifically the subset of expert networks and transcript platforms whose logging infrastructure was built as an internal debugging surface rather than as a product.

The European parallel: MiFID II Article 16 pushes the same way

In Europe, the pressure comes from a different direction but ends in the same architecture. MiFID II Article 16 and the ESMA guidelines on telephone recording and electronic communications require investment firms to record communications intended to lead to a transaction and to retain those records for at least five years, extendable to seven. The guidelines are written around voice and electronic messaging, but the underlying principle (that the firm must be able to reconstruct the information environment in which an investment decision was made) scales naturally to agent-generated research events.

European buy-side desks have, in our observation, moved earlier on structured event-feed requirements than their US counterparts, in part because the MiFID II recordkeeping culture was already more comfortable with the idea that reconstruction, not just retention, is the compliance test. US desks are now catching up through the 17a-4 amendment pathway, and the result is a converging global baseline rather than two divergent regimes. A vendor that builds its event-emission layer to satisfy a US broker-dealer under the amended 17a-4 is, with modest adjustment, satisfying a European MiFID II firm as well. The commercial payoff of building this once is significant.

The counterargument: is this really the vendor's problem?

There is a reasonable objection that we have heard from several research-vendor product leaders, and we take it seriously. The objection runs: the recordkeeping obligation is the broker-dealer's, not the vendor's. The vendor can supply raw logs on request. The buy-side firm's own middleware can parse, structure, and forward those logs into the archive. Why should the vendor invest in a first-class event-emission product when the responsibility legally sits one layer downstream?

The answer, in our read, is that the market has already decided this question through RFP behaviour, not through regulation. A buy-side firm choosing between two expert networks of comparable content quality will, in 2026, select the one whose event feed drops cleanly into Global Relay or Smarsh over the one that requires a bespoke integration effort by the firm's own engineers. The second vendor is not disqualified by any rule. It is disqualified by the operational cost of adopting it. That is a market signal, and vendors are responding to it on commercial grounds regardless of where the strict legal responsibility sits.

There is also a secondary consideration. A vendor whose logs are produced on request, in whatever ad-hoc format a support engineer can assemble, is a vendor whose logs will be challenged in a dispute. A vendor whose logs are a documented product surface, with a published schema, versioned contracts, and attestations about clock sources and content hashing, is a vendor whose logs will be relied on. The commercial defensibility of the research itself (the ability for a buy-side analyst to say in an IC memo that a specific segment of a specific expert call informed a specific thesis) depends on the log being credible, not merely available.

The fourth pillar on top of three earlier ones

INFLXD has covered three prior infrastructure requirements that are now shaping research-vendor procurement. The first is MCP handshakes, the emerging convention for how agents discover and invoke tools exposed by vendor platforms. The second is SSO and SCIM federation, which allows a buy-side firm to provision and deprovision agent and human identities centrally and to attach entitlements to those identities. The third is transcript-provenance signing, which binds a specific transcript artifact to a cryptographic attestation of its source and completeness.

The audit-trail layer sits on top of all three, and depends on all three. MCP gives the agent a typed way to invoke the vendor's capabilities, which is what makes typed, enumerated events possible in the first place. SSO and SCIM give the event log a resolvable actor identity rather than a shared service account. Provenance signing gives the event log a credible content hash to bind each action to. Without the first three, the fourth is a stream of untyped actions by anonymous actors against unverifiable content. With them, the fourth is a defensible compliance artifact.

In our view, the vendors who will dominate the 2026 and 2027 enterprise cycle are the ones who have deliberately stacked the four pillars in the right order, rather than treating each as an isolated feature request. The audit-trail layer is not an add-on. It is the surface on which the first three become commercially legible to a compliance organisation.

Worked example: an IC memo under the new pathway

Consider a buy-side analyst preparing an investment-committee memo on a mid-cap semiconductor company. The analyst asks an agent to summarise the company's exposure to a particular customer concentration risk. The agent, over the next ninety seconds, pulls three expert-call transcripts from the firm's expert-network vendor, reads seven specific segments across those transcripts, cross-references two sell-side notes already in the firm's internal library, pulls the latest 10-Q from the firm's filings database, and produces a four-paragraph summary with inline citations.

Under the pre-amendment model, the firm's compliance archive captures the four-paragraph summary when the analyst saves it, and separately captures the underlying transcripts and sell-side notes under their respective retention schedules. The link between the summary and the specific segments that informed it is implicit, reconstructable only by rereading the summary against the transcripts.

Under the audit-trail pathway, the compliance archive captures a structured event trajectory: the analyst's prompt, the agent's identity and authorisation, each of the seven segment reads with their content hashes, each of the external tool calls, and the final summary with a hash binding it to the full input chain. A compliance reviewer, two years later, responding to a regulatory request about the memo, can reconstruct not just what the analyst saw but what the agent considered and did not use, in what order, at what time. That is a materially stronger evidentiary record, and it is only possible if the expert-network vendor at the start of the chain emitted the segment-read events in a form the archive could ingest.

What to watch

Three signals, in our view, will indicate how fast this shift is consolidating.

The first is the appearance of event-feed specifications in published RFP templates from the large multi-strategy funds and the top-tier allocators. These templates propagate quickly through the industry and become de facto standards within two or three procurement cycles.

The second is explicit audit-trail certification language in the SOC 2 and ISO 27001 reports that research vendors publish annually. The vendors who are serious about this are already extending their control narratives to cover event-emission completeness and schema stability. The vendors who are not will be visibly absent from that language within a year.

The third is partnership announcements between research vendors and the archive platforms. Pre-built connectors between an expert-network vendor and Global Relay, Smarsh, or Theta Lake are the clearest commercial proof that a vendor has treated the event log as a product rather than an export. We would expect to see several of these announced through 2026 and 2027 as the category formalises.