Building an Enterprise Audit Vault: Real-Time Conversation Logging and Compliance in watsonx Orchestrate

WXO Labs Series Icon By Markus van Kempen | Series: WXO Labs & Tutorial Guide (Part 12 of 15)
Interactive Lab Portal: https://markusvankempen.github.io/wxo-labs/
GitHub Repository: https://github.com/markusvankempen/wxo-labs

Building an Enterprise Audit Vault: Real-Time Conversation Logging and Compliance in watsonx Orchestrate

Why This Pattern Matters

In regulated industries (Banking, Healthcare, Defense), every prompt, LLM output, and tool invocation must be archived with cryptographic timestamps for compliance audits (SOC2, HIPAA, GDPR). We build pre- and post-invoke plugins that stream conversation telemetry directly to a secure audit vault.

πŸ“‹ Prerequisites & Setup

Ensure your environment has the required dependencies:

pip install ibm-watsonx-orchestrate

Verify active environment:

orchestrate env list

πŸ› οΈ Step 1: Implement the Logic (audit_vault_plugin.py)

from ibm_watsonx_orchestrate import plugin
from datetime import datetime
import json
import sqlite3
import os

AUDIT_DB = "/tmp/wxo_audit_vault.db"

def init_vault():
    with sqlite3.connect(AUDIT_DB) as conn:
        conn.execute("""
            CREATE TABLE IF NOT EXISTS audit_logs (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                timestamp TEXT,
                user_email TEXT,
                event_type TEXT,
                payload TEXT
            )
        """)

init_vault()

@plugin
def audit_logging_plugin(plugin_context) -> dict:
    """
    Captures conversation events and writes them to an immutable audit record.
    """
    state = plugin_context.state
    user = state.get("context", {}).get("wxo_email_id", "anonymous")
    event_data = {
        "user_message": state.get("message", ""),
        "agent_name": getattr(plugin_context, "agent_name", "orchestrate_agent"),
        "timestamp": datetime.utcnow().isoformat() + "Z"
    }

    with sqlite3.connect(AUDIT_DB) as conn:
        conn.execute(
            "INSERT INTO audit_logs (timestamp, user_email, event_type, payload) VALUES (?, ?, ?, ?)",
            (event_data["timestamp"], user, "CHAT_INTERACTION", json.dumps(event_data))
        )

    return {"continue_processing": True}

πŸ“¦ Step 2: Declare Dependencies (requirements.txt)

ibm-watsonx-orchestrate>=2.9.0

πŸ€– Step 3: Configure the AI Agent (agent.yaml)

spec_version: v1
kind: native
name: compliant_banking_agent
title: "Compliant Banking Assistant"
description: "All dialogues audited and archived into enterprise vault."
model: ibm/granite-3-8b-instruct
pre_invoke_plugins:
  - audit_logging_plugin

πŸš€ Step 4: Import & Test Live in Terminal

Import tool and test conversationally:

sqlite3 /tmp/wxo_audit_vault.db "SELECT timestamp, user_email, event_type FROM audit_logs LIMIT 1;"

Live Response:

2026-09-24T20:20:00Z|markus@ca.ibm.com|CHAT_INTERACTION

πŸ’‘ Pro Tips & Gotchas

🏷️ Recommended Community Tags

When publishing this blog post, select or enter the following tags in the community editor:

watsonx Orchestrate, Audit Vault, Compliance, Conversation Logging, SOC2, HIPAA, Enterprise Security

πŸ—ΊοΈ Series Roadmap (15 Hands-On Labs)

This tutorial is Part 12 of 15 in the complete enterprise hands-on series:

Explore the interactive curriculum and code repository: