Logging every LangGraph tool call as FINRA Rule 4511 books and records

Treat Rule 4511 as a records-integrity problem

FINRA Rule 4511(a) requires members to make and preserve the books and records required under FINRA rules, the Exchange Act and the applicable Exchange Act rules. Rule 4511(b) sets a default of at least six years for FINRA books and records where no period is specified elsewhere. Rule 4511(c) requires books and records required under FINRA rules to be preserved in a format and media that comply with SEA Rule 17a-4. As of November 2026, the rule is current on the FINRA rulebook.

FINRA's 2026 Annual Regulatory Oversight Report adds a GenAI section noting that AI agents may call for supervisory processes specific to the type and scope of the agent. Its books-and-records discussion cites SEA Rules 17a-3 and 17a-4 and FINRA Rule 4511, and it says firms should monitor prompts, responses and outputs of GenAI solutions.

No rule text defines a tool call record as a required record. FINRA has also said that whether a communication must be retained depends on its content, not on the technology used. The practical design consequence is to capture each call's content and outcome completely, so your compliance team can classify and retain records according to its own determination. The engineering question is integrity: is every call recorded, is the record complete, can it be altered, and can it be retrieved?

Why callbacks and application logs fall short

This is an engineering judgment, not a statement of regulatory text. Application-level callbacks and tracing share three weaknesses when measured against a records standard.

Completeness: a handler only sees what is routed through it. A tool invoked outside the instrumented path, a handler that is not attached to a sub-graph, or a failure in the logging call itself produces a silent gap. Blocked and escalated calls are the most likely to be missed, because many logging designs record executions and not refusals.

Immutability: logs written to files or general-purpose databases can usually be edited or deleted by anyone with write access. An examiner has little reason to trust a record that the system's own operators could have changed.

Retention: application logs rotate on operational schedules. Nothing ties them to a retention period, and nothing maps them to the record types a firm has classified.

The fix is not a better logger. It is to move capture to a point that every call must cross, and to write records to a store whose properties you can demonstrate.

Design capture, retention and retrieval

Record the decision before the tool executes and the result after it returns, so a crash between the two still leaves evidence of the attempt. Then build the store and the checks around that.

• Capture at a mandatory choke point: Route every tool through one enforcement layer, and treat any tool reachable another way as a defect.
• Record all outcomes: Blocked, redacted and escalated calls need the same record as allowed ones.
• Assess the store against 17a-4: Rule 4511(c) points to SEA Rule 17a-4, and FINRA's 2026 report says 17a-4(f) sets format requirements for electronic recordkeeping systems. Have compliance counsel confirm that your storage format and media meet them.
• Reconcile automatically: The 17a-4 text includes a provision on automatic verification of completeness and accuracy of electronic storage processes. Compare invocation counts with stored record counts on a schedule and alert on any difference.
• Map retention per record type: The six-year period is a default, and account-related records may run from account closure. Do not apply one blanket value.
• Version policy documents: Policies explaining what applied to a call may fall under 17a-4(b)(7) for compliance and supervisory manuals. Link each record to a policy version.

Enforcing policy in the execution path, and where that stops

Capturing at the point where policy is enforced gives one practical benefit: the record and the decision come from the same place. When policy is enforced at runtime, not reviewed after the fact, each call produces a decision and a record together, so a blocked call is evidence by construction rather than something reconstructed from partial logs.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions to allow, redact, block, rate limit or escalate for human approval, scoped to individual interactions and tool calls. That enforcement generates audit-ready evidence. Trussed can be deployed self-managed in the customer cloud, with configurable retention and data residency, which matters when retention periods and storage location are firm decisions rather than vendor defaults. Trussed does not trace agentic workflows end to end or govern at the transaction level, so reconstructing a full business process across agents remains separate work.

No engineering pattern makes a firm compliant with Rule 4511. Deciding which records are required, setting retention periods, confirming 17a-4 format compliance and documenting agent scope in written supervisory procedures under Rule 3110(b)(1) stay with your compliance and legal teams. This guide is not legal advice. What engineering can supply is complete, durable and retrievable evidence for those teams to work from.