CrewAI Compliance: How to Add Audit Logging to Multi-Agent Pipelines
CrewAI's role-based model makes tasks the natural compliance audit boundary — each task has a specific agent role, a defined input, and a captured output. Compliance logging uses three integration points: task callbacks (per task completion, for sequential and hierarchical crews), step_callback (per agent action step including tool calls), and @listen decorators (for Flows state transitions). A shared decision_id generated at crew entry links all tasks in a pipeline run. Ghost SDK's fire-and-forget capture() call adds under 5ms overhead and no changes to agent logic.
Task Callbacks for Sequential Crews
The simplest CrewAI compliance integration: add a callback= parameter to each Task constructor. The callback fires after task completion with the task output. The compliance callback extracts subject_id (passed via closure), decision_type (matching the task description), context (the inputs at decision time), action (the task output), and decision_id (shared across all tasks in the crew run). Ghost SDK fires asynchronously — no blocking of the crew pipeline. The decision_id UUID generated at crew entry links all task records, enabling full pipeline reconstruction by querying by decision_id.
Flows @listen Decorators as Compliance Capture Points
CrewAI Flows use @start and @listen decorators to define state machine pipelines. Each @listen method is a natural compliance capture point: the flow is between states, you have the complete current state, and the decision that caused the transition. Ghost SDK captures at each @listen method with the current state as context and the state transition as the action. The Flows pattern is especially useful for multi-stage decisions (e.g., coverage analysis → adjudication → payment approval) where each stage requires a separate compliance record with the same decision_id.
step_callback for Tool-Use Capture in Hierarchical Crews
CrewAI's hierarchical process uses a manager agent to delegate to worker agents. The step_callback parameter on the Crew fires after every agent action step — including tool calls, which are the most consequential actions in most crews. In the step_callback, check agent_action.tool to filter for substantive tool calls (excluding delegation steps) and capture with Ghost SDK. This pattern captures decisions at the tool-use level rather than the task level — more granular but also higher volume. Use step_callback for crews where tool calls have direct real-world effects (database writes, API calls, notifications).
Framework Compliance Requirements for CrewAI
EU AI Act Article 12: task callback records must include complete task input as context, agent role in metadata, task output as action, and subject_id — linked by decision_id for full pipeline reconstruction. HIPAA §164.312(b): subject_id must use internal patient identifier (not raw PHI in the record), context field should capture data references rather than raw PHI, retain records for 6 years, encrypt in transit and at rest. SOC 2 CC7.2: establish decision_type distribution baselines at deployment; alert when task completion rates or output semantic similarity deviate beyond threshold. GDPR Article 22: per-subject records retrievable by subject_id for data subject access requests; crew task structure provides the logical explanation of decision reasoning.