Agent infrastructure
The moment an agent can spend, send, sign, or ship, "what did it do and why" stops being a debugging question and becomes a liability question. Transcripts and traces don't answer it. Here is what does.
Chat logs record conversation. Agents take actions.
A chatbot that gives a wrong answer embarrasses you. An agent that acts on one — places the order, approves the refund, updates the ledger, messages the customer — creates facts in the world that someone later has to defend. And agents compound the problem in ways ordinary software doesn't: they act autonomously (no human clicked "confirm" on each step), compositionally (one agent delegates to another, and responsibility smears across the chain), and on model-generated evidence (a step's input is often another model's unverified output).
When the question arrives — from a customer, an auditor, opposing counsel, or your own post-incident review — a folder of traces and chain-of-thought text answers almost none of it. Reasoning text is narrative: it cannot be re-run, it proves nothing about what the agent actually knew, and whoever operates the logging stack could have edited it.
Work backwards from the person holding the "why did your agent do this" letter.
The consequential action — not the token stream around it. Approve, deny, execute, escalate, or the one that saves you: withheld.
Each input graded by provenance: verified against an authoritative source, modeled, or merely asserted by another model. An agent acting confidently on ungraded evidence is the incident report you haven't had yet.
Which principal, which delegation, which configuration of rules — pinned to versions, so "the policy changed since then" is a checkable claim instead of an escape hatch.
The strongest evidence of a well-governed agent is a sealed record of the times it declined to act because required evidence was missing or stale. Refusals that vanish from the record aren't governance; they're curation.
If verifying the record requires your servers or your goodwill, its evidentiary weight approaches zero exactly when stakes are highest. The record must be tamper-evident, independently time-anchored, and re-runnable by a stranger.
One sealed receipt per consequential decision — human or machine.
Corobate's answer is the attestation receipt: at each consequential step, the agent's evidence is graded, its confidence is capped by the weakest required input, the verdict — including honest abstention — is sealed into a hash-chained record, and the seal is anchored to an RFC 3161 public timestamp authority unaffiliated with us or with you. The receipt travels with the work. Anyone — customer, auditor, counterparty — can verify it in a browser, offline, without asking permission.
Delegation chains compose the same way: each hop issues its own receipt, so "which agent, on whose authority" has an answer at every level rather than a shrug at the end. And because receipts are reproducible, your post-incident review can re-run the decision as the agent saw it — not as memory and stale dashboards reconstruct it.
Sparse, stale, and AI-hallucinated evidence in a long-tail supply-chain decision — worked end to end.
Every term in plain language, with a live demo you can tamper with.
The regulatory floor under all of this, for systems that qualify as high-risk.
The vocabulary — attestation receipt, decision provenance, gated confidence — a paragraph each.