AI response metadata stored for audit trail

NIST AI RMF GOVERN 1.7 requires organizations to maintain documentation of AI system decisions. ISO/IEC 27001:2022 A.8.15 (Logging) and NIST SP 800-53 Rev. 5 AU-3 require sufficient log detail to reconstruct events. When AI responses are stored without model version metadata, it becomes impossible to explain to a user why they received a particular response, identify which responses might be affected by a model deprecation or safety issue, or meet audit requests about AI decision provenance. Storing model: 'gpt-4o' alongside each response is a three-field schema change with significant operational value.

Extend your message schema to capture model version and provider alongside every AI-generated response. This costs one extra column and is populated directly from the API response object.

// schema.prisma
model Message {
  id           String   @id @default(cuid())
  role         String
  content      String
  model        String?  // e.g., "gpt-4o", "claude-3-5-sonnet-20241022"
  provider     String?  // e.g., "openai", "anthropic"
  promptTokens Int?
  outputTokens Int?
  createdAt    DateTime @default(now())
}

Populate it from the API response:

await db.message.create({
  data: {
    role: 'assistant',
    content: response.choices[0].message.content,
    model: response.model,          // comes back on every API response
    provider: 'openai',
    promptTokens: response.usage?.prompt_tokens,
    outputTokens: response.usage?.completion_tokens,
  }
})

The model field from the API response is always the resolved model name (e.g., gpt-4o-2024-11-20), which is more precise than the model alias you requested — store the API-returned value, not your request value.