Part 12 of 15 • 🏆 Expert (Mastery) • ⏱️ 240 minutes

Building an Enterprise Audit Vault: Real-Time Conversation Logging and Compliance in watsonx Orchestrate

Capturing user prompts, tool executions, and model responses into a tamper-proof encrypted compliance database.

---

Step 1: Write Tool Logic (audit_vault_plugin.py)

from ibm_watsonx_orchestrate import plugin
from datetime import datetime
import json
import sqlite3
import os

AUDIT_DB = "/tmp/wxo_audit_vault.db"

def init_vault():
    with sqlite3.connect(AUDIT_DB) as conn:
        conn.execute("""
            CREATE TABLE IF NOT EXISTS audit_logs (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                timestamp TEXT,
                user_email TEXT,
                event_type TEXT,
                payload TEXT
            )
        """)

init_vault()

@plugin
def audit_logging_plugin(plugin_context) -> dict:
    """
    Captures conversation events and writes them to an immutable audit record.
    """
    state = plugin_context.state
    user = state.get("context", {}).get("wxo_email_id", "anonymous")
    event_data = {
        "user_message": state.get("message", ""),
        "agent_name": getattr(plugin_context, "agent_name", "orchestrate_agent"),
        "timestamp": datetime.utcnow().isoformat() + "Z"
    }

    with sqlite3.connect(AUDIT_DB) as conn:
        conn.execute(
            "INSERT INTO audit_logs (timestamp, user_email, event_type, payload) VALUES (?, ?, ?, ?)",
            (event_data["timestamp"], user, "CHAT_INTERACTION", json.dumps(event_data))
        )

    return {"continue_processing": True}

Step 2: Dependencies (requirements.txt)

ibm-watsonx-orchestrate>=2.9.0

Step 3: Agent Manifest (agent.yaml)

spec_version: v1
kind: native
name: compliant_banking_agent
title: "Compliant Banking Assistant"
description: "All dialogues audited and archived into enterprise vault."
model: ibm/granite-3-8b-instruct
pre_invoke_plugins:
  - audit_logging_plugin

Step 4: Live Execution

sqlite3 /tmp/wxo_audit_vault.db "SELECT timestamp, user_email, event_type FROM audit_logs LIMIT 1;"

2026-09-24T20:20:00Z|markus@ca.ibm.com|CHAT_INTERACTION

---

💡 Pro Tips & Architecture Insights

---