docs: added meeting notes for audit logging wg track

Signed-off-by: Alan Pinkert <apinkert@cisco.com>

Author: alanisaac

docs/contribute/wip/5_Audit_Logs_Standardization/meeting_notes/2026-01-20.md

@@ -0,0 +1,51 @@
+# Notes
+
+* Reviewed last session’s meeting notes
+* Reviewed auditing requirements document
+* Privacy & Security
+    * Compliance frameworks are interesting
+* We should focus on areas where no one is working
+    * Identity & AuthZ
+        * Biggest challenge at the conference was “acting on behalf-of”
+        * Many are doing impersonation (hand your personal creds to the agent)
+        * Delegation chains (agent inheriting two roles)
+            * Example: order a new laptop
+            * Finance agent needs to check budget and need to check the employee’s context
+            * In the end, it’s still token exchange
+        * Customer conversations?
+            * Who is using MAS systems and can we ask about their use cases
+            * Action Item: Julu + Chun set up conversation with users
+            * Action Item: are there any customers worried about compliance with AI acts?
+* The rest of the meeting focused on a discussion of use cases and personas.  Here's what the group came up with for personas:
+
+* Personas 
+    * Higher priority - Identity 
+        * Security Professionals 
+            * Cares about:  
+                * where did credentials come from,  
+                * what type of credentials are they (service account, impersonation, on behalf of), 
+                * which agent used it,  
+                * what access does it represent (resource, internal vs external), 
+                * what policies were enforced, and what was the verdict (both approved and rejected access) 
+                * who is responsible for the system(s) in question (agent, resource, credential, etc.) 
+                * audit logs are machine-readable, can be fed into agentic support systems 
+        * Support Teams (audit-logs-as-training-data) 
+        * Compliance Professionals 
+            * Cares about: 
+                * are the systems involved compliant with various frameworks 
+                * what are the boundaries between internal and external systems
+                * how is data transferred and across what geographies / jurisdictions 
+                * how are privacy and security handled in the involved systems 
+                * data retention and destruction (log storage) 
+    * Lower priority (not a part of the identity working group)
+        * Agent and Agentic Resource Developers 
+
+# Action Items
+
+1. Continue nailing down persona / use cases
+    1. Ask Jim about the Support Team persona  
+    2. Julu + Chun set up conversation with folks with Multi-Agent Systems
+    3. General call: are there any practitioners worried about compliance with AI acts?
+2. What are the data points that we need recorded
+3. Look at existing standards & frameworks, compare to 2. above
+4. Converge: pursue these tracks