Source: Docker Blog — 2026-08-03
Summary
Docker expanded its AI Governance product on August 3, 2026 with audit logging that streams every policy decision an AI agent triggers — what it did, and what a policy blocked — into a searchable record in Docker Cloud, with 90-day retention, CSV export, and direct streaming to SIEM tools like Splunk and Dynatrace over a generic HTTPS connection. The feature builds on Docker AI Governance (originally launched in May 2026) and targets a specific operational gap: security teams already trust a SIEM they use every day, and agent activity needs to show up there, not in a separate AI dashboard nobody on the security team actually checks.
Key Takeaways
- Every policy decision an agent triggers gets logged, including attempts a policy blocked, not just successful actions — which matters for catching and reviewing blocked misuse or misconfiguration attempts, not just approved ones.
- Audit data streams into Docker Cloud for a single, searchable, org-wide view, with 90-day retention and CSV export built in for compliance and reporting workflows.
- Direct SIEM streaming (Splunk and Dynatrace named, plus any tool reachable over a generic HTTPS connection) means security teams don't have to context-switch into a separate AI governance tool — agent audit trails land where incident response already happens.
- Local disk delivery still works alongside SIEM streaming, and both modes can run at the same time, so teams aren't forced to pick one delivery path over the other.
Reel Script
Hook (~16s, 37 words) Your security team already lives in a SIEM every single day. Until this week, what your AI agents actually did lived somewhere else entirely — a separate dashboard nobody on that team ever opens. Docker just closed that gap.
Core Concept (~55s, 120 words) The concept here is policy-as-audit-trail. Every time an AI agent tries to do something — call a tool, touch a system, take an action — a policy engine evaluates that attempt and either allows it or blocks it. What's new is that decision itself, allow or block and why, now gets logged and shipped out automatically. Think of it like a building's badge-swipe log, except the badge holder is an AI agent: every door it tried, and whether it actually opened. Most AI governance dashboards keep that log to themselves, in a separate tool security teams have to remember to check — which in practice means they don't check it.
Hands-On (~50s, 115 words) The pipeline is worth sketching out: an agent takes an action, Docker's AI Governance policy engine evaluates it against the org's rules, and the decision — allowed or blocked, with the reason — gets written to Docker Cloud, where it's searchable org-wide with 90-day retention and CSV export for audits. From there, the same event streams over a generic HTTPS connection directly into whatever SIEM the security team already runs — Splunk and Dynatrace are named specifically. Local disk delivery keeps working in parallel too, so a team can have both the SIEM feed and a local copy running simultaneously instead of choosing one.
Takeaway (~18s, 46 words) Agent audit logs are only useful if they land where security teams actually work, and routing straight into an existing SIEM instead of a bespoke AI dashboard is the right default. If you're running agents against production systems, check whether your tooling can prove what they did — not just what they were allowed to do.