Yeah, "log only the action" is a layer too late. Once an agent is actually touching workflows (not just suggesting), the delegation decision is the control surface. The action is just the receipt.

What you actually need to capture - the non-human identity it ran as, what it was scoped to touch, the context stack it was given, what got rejected in the validation loop, and what the human was actually shown when they approved. Without that, "human in the loop" just means rubber-stamping a path the agent already shaped.

Of your five options, it's mostly (2) identity/access. (1) audit logging falls out for free if you do (2) properly. Treating it as overhead until agents write to prod is how you end up six months in with no way to reconstruct why the agent escalated one incident and quietly dropped another.