CAN WE PROVE WHO REALLY DECIDED?
From Event Logs to Authority Provenance
Martin Novak
Synthocracy Institute
Research status: 4 September 2026
Evidence Boundary
This article distinguishes documented developments from analytical synthesis. [A] Empirical claims refer to legislation and legislative proposals, regulatory texts, standards work, technical research, and documented governance architectures available by 4 September 2026. [B] Analytical claims develop the Synthocracy Institute’s interpretation of those developments.
The article does not argue that technical logs are unimportant. The opposite is true: reliable logging, tamper evidence, stable identities, correlation identifiers, and execution traces are becoming indispensable as AI systems move from producing outputs to taking actions. The narrower claim is that a technically accurate record of what happened does not necessarily establish why the action was legitimate, who possessed the relevant decision authority, how that authority reached the acting system, or whether it remained valid when the action occurred.
The Synthocracy Institute uses authority provenance as a working analytical term for that missing layer:
AUTHORITY PROVENANCE — The reconstructable chain showing the legitimate source, holder, delegation, scope, conditions, and exercise of authority behind a consequential human or machine action.
The distinction already exists in the Institute’s wider research architecture: technical events, decision provenance, and authority evidence should be connected but not collapsed into one another.
The log is perfect. The explanation is not.
Imagine an investigation six months after an AI-mediated financial incident.
The organisation has excellent telemetry.
At 09:14:03, Agent A received a task.
At 09:14:07, Agent A called Agent B.
At 09:14:19, Agent B queried a supplier database.
At 09:15:02, Agent B delegated execution to Agent C.
At 09:15:11, Agent C authenticated successfully.
At 09:15:13, Agent C invoked:
payment.execute
At 09:15:14, €82,000 left the organisation’s account.
Every timestamp is preserved. Every identity is authenticated. The cryptographic hashes match. No record has been altered. The transaction can be reconstructed almost perfectly.
We know what happened.
We still may not know who really decided.
Who was the principal?
What exactly had the principal authorised?
Was Agent A permitted to choose the supplier, or merely identify candidates?
Did A possess the right to delegate purchasing discretion to B?
Did B have the right to delegate execution to C?
Was the €82,000 inside a legitimate budget or merely below a technical transaction ceiling?
Had the mandate expired?
Had a relevant condition changed after the original approval?
Did Agent C possess decision discretion, or was it supposed to execute only a decision already made elsewhere?
Did a human approve the transaction? If so, what did that human actually see?
The technical record can be immaculate while the authority record remains incomplete.
That is the problem at the centre of this article:
EVENT PROVENANCE ≠ AUTHORITY PROVENANCE.
A log showing that an agent executed an action proves execution.
It does not, by itself, prove the right to execute it.
1. Why this question became more urgent this week
On 3 September 2026, U.S. Representatives Josh Gottheimer and Mike Lawler introduced the bipartisan Stop Rogue AI Act, a proposal directing the National Institute of Standards and Technology to develop standards, guidelines, and best practices for securely deploying AI agents. According to the sponsors’ published description, those standards would cover continuous verification of agent actions, security and reliability evaluation, tamper-resistant records of agent activity, and a continuous, machine-readable inventory of all AI agents operating in an organisation. The proposal would be voluntary for most organisations but would push federal contractors toward compliance if enacted. (lawler.house.gov)
This is an important development.
It moves agent governance away from vague declarations such as “we supervise our AI” and toward concrete infrastructure:
identify the agents;
observe their actions;
preserve the records;
make tampering detectable;
verify what they do.
All of that is necessary.
But precisely because logging is becoming more serious, its limitation becomes easier to see.
A machine-readable inventory may establish that Agent C existed.
A tamper-resistant log may establish that Agent C executed a transaction.
Continuous verification may establish that its credential was valid and its action complied with a technical policy.
None necessarily establishes the authority basis from which the consequential action derived.
The emerging policy question is therefore not whether we should log agents.
We should.
The harder question is:
What must be preserved alongside the log so that an auditor can reconstruct not only the action chain, but the authority chain?
That is why the problem is more urgent now than it was a month ago. Agent logging is moving from a research concern toward a potential governance primitive. If we standardise only event evidence, we risk constructing excellent machinery for proving what machines did while still being unable to prove who was entitled to make the decision that caused them to do it.
2. Logging computation is not the same as logging governance
The EU AI Act already demonstrates why logging matters. Article 12 requires high-risk AI systems to technically allow automatic recording of events over their lifetime at a level appropriate to the system’s purpose. Those records are intended to support risk identification, post-market monitoring, and operational oversight. Article 14 separately requires effective human oversight, including the ability, where appropriate and proportionate, to interpret outputs, disregard or override them, reverse them, intervene, or stop the system. (Eur-Lex)
The separation is revealing.
Record-keeping and human authority are separate governance requirements.
A log is evidence about system operation.
Human oversight concerns the distribution and exercise of control.
The two can support each other, but one does not automatically establish the other.
The Institute’s Decision Authority Record was designed around exactly this distinction. Its existing specification states that technical permission—an API key, role-based access entry, or OAuth token—must not be treated as the sole authority basis for a consequential action. Legitimate authority may instead derive from law, regulation, administrative mandate, contract, organisational policy, role assignment, consent, a court order, emergency authority, or another identifiable basis.
This distinction becomes particularly important with agents because an action can be technically valid at every layer.
The identity is genuine.
The authentication succeeds.
The API permission exists.
The request is properly formatted.
The transaction completes.
And yet the organisation may still be unable to show that the acting agent was legitimately empowered to choose that action under those circumstances.
A perfectly functioning system can execute a badly governed decision.
3. Three different questions require three different kinds of evidence
A useful way to clarify the problem is to separate event provenance, decision provenance, and authority provenance.
Event provenance
Event provenance answers:
What happened?
It may record:
which agent called which tool;
which credential was used;
which resource was accessed;
which model version ran;
which value was written;
which transaction executed;
when the action occurred;
what result the system returned.
Event provenance is indispensable for debugging, security analysis, incident response, and forensic reconstruction.
Decision provenance
Decision provenance asks a broader question:
How did the consequential outcome come to be selected?
The Institute’s existing framework defines it as the reconstructable history of materially relevant inputs, transformations, model outputs, human interventions, rules, and actions through which an outcome was produced.
For example, a log may show that an applicant was moved to REJECTED.
Decision provenance would seek to reconstruct:
which information entered the process;
which model ranked the applicant;
which threshold was applied;
which other applicants were visible;
whether a recommendation was generated;
what the recruiter saw;
whether a human changed the recommendation;
what action finally produced the rejection.
Authority provenance
Authority provenance asks something different again:
Under whose legitimate mandate did these consequential choices occur?
It seeks to reconstruct:
the source of authority;
the authority holder;
the principal;
the mandate;
the delegation chain;
the limits imposed;
the relevant decision discretion;
the authority actually in force at the time;
the power to refuse, revoke, reroute, or stop;
and the actor ultimately answerable for the exercise of that authority.
All three layers matter.
A mature accountability architecture may therefore need:
SYSTEM LOGS → DECISION PROVENANCE → AUTHORITY PROVENANCE.
System logs tell us what the machinery did.
Decision provenance tells us how the outcome emerged.
Authority provenance tells us who had the standing to make the consequential choices inside that process.
The Institute’s existing research makes the same point in practical terms: a decision can be technically reconstructable yet institutionally unintelligible. We may know what every server did while remaining unable to identify who was authorised to decide.
4. payment.execute = success proves less than it appears to prove
Return to the payment agent.
Suppose the log contains:
agent_id: C-8472
principal_context: Corp-124
action: payment.execute
amount: 82000
currency: EUR
result: success
timestamp: 09:15:13
signature: valid
This is powerful evidence.
It may prove that C-8472 acted.
It may prove that the action was not retrospectively fabricated.
It may prove which account and endpoint were involved.
It may prove which technical principal context the system associated with the call.
It still may not prove the answer to the governance question.
Perhaps Corp-124 had authorised Agent A to research procurement options up to €100,000.
Perhaps a poorly designed internal workflow interpreted the monetary limit as spending authority.
Agent A delegated “complete supplier analysis” to Agent B.
B selected a supplier and instructed C to execute.
C inherited credentials that technically permitted the transaction.
The event chain is valid.
The authority chain is not.
The critical failure occurred not at payment.execute.
It occurred earlier when:
research authority became purchasing authority.
This is why the relevant governance record must connect:
authority basis → mandate → delegation → permission → decision → action → consequence.
Without those links, the transaction log describes the endpoint of the process while remaining silent about the legitimacy of the path that produced it.
5. Identity is essential—and still insufficient
NIST has made agent identity and authorization a central part of its 2026 work. Its National Cybersecurity Center of Excellence is examining how organisations can reliably identify AI and software agents, control their access and actions, audit them, and support non-repudiation. NIST explicitly notes that organisations are moving from AI systems that generate outputs toward agents capable of taking actions and making decisions with limited human supervision. (NCCoE)
On 27 August, NIST further argued that early agent deployments are recreating familiar identity-management mistakes: agents borrowing human credentials, receiving overly broad or long-lived permissions, and becoming difficult to distinguish from the users for whom they act. The recommended direction is stronger first-class identity for agents, more tightly scoped delegated authorization, and better traceability across agentic chains. (NIST)
This is foundational work.
But identity and authority remain different.
If the log tells us:
Agent C acted on behalf of Employee H,
we have gained something important.
We still need to know:
What had H legitimately delegated?
The same employee may possess authority to research suppliers but not approve payments.
A doctor may possess authority to prescribe but not alter an insurance determination.
A government official may possess authority to review a case but not delegate statutory discretion to an external agent.
A corporate manager may possess authority to approve expenditure but not to subdelegate it beyond a particular team.
Knowing who stands behind the agent is necessary.
It does not tell us automatically what legitimately travelled from that actor to the machine.
6. Multi-agent systems turn provenance into a chain problem
The problem becomes much harder once agents delegate to agents.
The path may look like:
HUMAN H → AGENT A → AGENT B → AGENT C → TOOL D → EXTERNAL SERVICE E.
A conventional distributed trace can often reconstruct the calls.
A richer governance trace has to reconstruct something else in parallel:
H held authority X.
H delegated X1 to A.
A was permitted to delegate only X2 to B.
B delegated execution X3 to C.
C invoked Tool D.
D changed the external state at E.
The distinction is subtle but fundamental.
Network provenance traces communication.
Authority provenance traces legitimate power.
The IETF’s May 2026 Internet-Draft on auditing AI-agent delegation identifies almost exactly this gap. The authors note that traditional auditing often captures isolated system events but fails to preserve user intent, delegation relationships, and changing authorization. Their proposed architecture therefore links intent, delegation, authorization, and execution, with records for interactions, actions, delegation, and authorization transitions. Authorization is treated as a time-evolving state rather than a static attribute. (datatracker.ietf.org)
The draft goes further. It proposes that an auditor should be able to determine whether recorded behaviour matched both the user’s intent and the authorization in force at the time, without requiring trust in the agent itself. (datatracker.ietf.org)
This is very close to the problem Synthocracy describes as authority provenance.
The significance is not that one Internet-Draft has solved the problem. Internet-Drafts are explicitly works in progress and may change or expire.
The significance is that independent technical standards work is converging on the same gap:
an execution trace without delegation context is not enough for agent accountability.
7. Authority is not static
Consider another example.
At 09:00, a human gives Agent A a mandate to resolve a customer dispute up to €1,000.
At 09:05, A delegates investigation to B.
At 09:10, B prepares a proposed €700 refund.
At 09:12, the customer supplies new evidence showing that the account may be linked to fraud.
At 09:13, organisational policy changes the case status to mandatory human review.
At 09:14, Agent C executes the refund using authority previously delegated by B.
Was C authorised?
If the system checks only the original credential, perhaps yes.
If governance asks which authority was in force after the fraud escalation, perhaps no.
This is why authorization and authority need temporal provenance.
The IETF auditing proposal explicitly models grants, step-up approvals, scope narrowing, revocation, and expiry as authorization transitions whose ordered sequence can reconstruct what authority existed at a particular moment. (datatracker.ietf.org)
A July Internet-Draft on AI-agent authentication and authorization similarly proposes that when an agent acts on behalf of a user or system, delegated context should be preserved as an input to authorization decisions and recorded in audit trails. It describes durable audit events containing the authenticated agent, delegated subject, accessed resource, requested action, authorization decision, relevant risk state, and subsequent remediation or revocation. (datatracker.ietf.org)
This is an important evolution.
The relevant question is no longer:
Did C possess a valid credential?
It becomes:
Was C still inside a valid chain of authority at the moment the consequential action occurred?
8. A human approval timestamp is not proof that a human decided
The same problem exists when a person appears in the log.
Suppose:
14:32:18 reviewer_184 approve = true
The organisation may describe the outcome as “human-approved.”
Technically, that is correct.
But the timestamp cannot answer:
whether Reviewer 184 saw the relevant primary evidence;
whether an AI system had already excluded alternatives;
whether the reviewer understood the model output;
whether three seconds or thirty minutes were available;
whether disagreement was institutionally protected;
whether the reviewer could change the route;
whether the action had already become practically irreversible;
whether the reviewer was approving a decision or merely acknowledging a system-generated conclusion.
This is why the Institute’s Who Really Decided? programme treats traceability and answerability as one condition of meaningful decision authority rather than treating the existence of a logged approval as sufficient.
A timestamp proves approval.
It does not prove judgment.
A human identifier proves participation.
It does not prove authority.
A signed action proves that a person or system authenticated the event.
It does not prove what that actor knew, could refuse, or legitimately controlled.
This difference will become increasingly important if institutions rely on human approval logs to defend consequential AI-mediated decisions.
The claim:
“a human approved it”
should become auditable as a governance proposition, not merely as an interface event.
9. The world is independently converging on the authority problem
The United States is not the only place where this issue is becoming visible.
At the July 2026 World Artificial Intelligence Conference in Shanghai, the Chair’s Statement declared that AI agents should operate with clearly defined decision-making authority and behavioural boundaries, supported by behaviour tracing and risk-alert mechanisms. (fmprc.gov.cn)
That sentence is unusually significant because it separates several governance requirements that are often collapsed:
decision-making authority;
behavioural boundaries;
tracing;
risk alerts.
Tracing shows what happened.
Defined authority specifies what the agent was entitled to decide.
Behavioural boundaries limit the action space.
Risk alerts help detect deviation.
No one component substitutes for the others.
This global convergence matters. The U.S. legislative debate is moving toward inventories, continuous verification, and tamper-resistant logging. NIST is working on agent identity, authorization, auditing, and non-repudiation. IETF drafts are attempting to connect intent, delegation, changing authorization, and execution. Chinese governance statements explicitly pair agent tracing with defined decision authority. (lawler.house.gov)
The common direction is becoming clearer:
The next generation of AI accountability will need to preserve not just activity, but the relationship between activity and authority.
10. Cryptographic proof can strengthen the chain—but cannot define legitimacy by itself
A new technical subfield is already emerging around cryptographically signed mandates and tamper-evident agent records.
One June IETF Internet-Draft proposes a Delegation Receipt Protocol in which a human principal signs an authorization object containing scope boundaries, time limits, an instruction hash, and other delegation information before the agent acts. Actions are then linked to the relevant authorization receipt in an append-only log. (datatracker.ietf.org)
An August arXiv preprint called Mandato similarly proposes digitally signed, machine-readable mandates enforced at the protocol layer, with tool constraints, contextual conditions, expiry, principal identity, and cryptographically chained audit records. (arXiv)
Another IETF draft proposes an Agent Audit Trail format with mandatory agent identity, action classification and outcome fields, using tamper-evident hash chaining and optional digital signatures. (datatracker.ietf.org)
These proposals are early. They are not established standards, and their legal or operational adequacy remains to be demonstrated.
But they reveal an important direction:
authority is beginning to acquire machine-readable artifacts.
That could significantly improve governance.
A future auditor may be able to establish:
this principal issued this mandate;
under this scope;
for this duration;
to this agent;
which delegated this narrower authority;
which produced this action;
whose execution record remains cryptographically linked to the mandate.
That would be a major advance over informal delegation and scattered application logs.
But cryptography cannot solve the entire authority problem.
A digitally signed mandate can prove that someone signed it.
It cannot by itself prove that the signer was legally entitled to delegate the power.
A signed corporate instruction cannot manufacture statutory authority.
A cryptographic record cannot establish that consent was valid merely because a private key was used.
An immutable log can preserve an abusive mandate perfectly.
The distinction therefore remains:
Cryptography can strengthen evidence of authority. It cannot determine the legitimacy of authority by itself.
The governance layer must still connect the technical artifact to the relevant institutional, legal, contractual, or procedural basis.
11. The same execution trace can correspond to different authority states
This is not merely philosophical.
A June 2026 preprint on observability for delegated execution makes a strong technical point: conventional audit logs and execution traces can be identical under different delegation assignments. The authors argue that delegation-scoped execution cannot reliably be reconstructed from standard observables alone when agents dynamically select tools, create different execution sequences, and spawn cooperating sub-agents. They propose binding delegation context to events at execution time rather than attempting to infer it afterwards. (arXiv)
Consider two identical traces:
A → B → C → Tool X → payment.execute
In Scenario One:
A had legitimate spending authority.
A delegated purchasing authority to B.
B narrowed it to one transaction.
C executed mechanically.
In Scenario Two:
A had research authority only.
B incorrectly inferred purchasing discretion.
C inherited a broad service credential and executed.
The event trace is identical.
The authority history is radically different.
This exposes the core weakness of forensic reconstruction after the fact.
If authority context was never preserved, the organisation may be forced to infer it from emails, policies, prompts, organisational charts, role definitions, vendor contracts, and incomplete human recollection.
The events survive.
The mandate disappears.
12. Even correct evidence may have the wrong authority
There is another subtle form of provenance problem.
An agent can reach the correct conclusion using evidence that was not authorised to determine the decision.
A July 2026 preprint on provenance sensitivity in LLM-agent action selection studies precisely this problem. The researchers distinguish whether information is merely relevant from whether its source is authorised for a particular tool or argument decision. Their experiments show that untrusted or unauthorised evidence can still influence agent actions despite source-authority cues. The reported rates are controlled stress-test results rather than real-world prevalence, but the conceptual point is important. (arXiv)
Suppose a hiring agent produces the same candidate ranking it would have produced using legitimate employment data—but one material feature came from a source the organisation was not permitted to use.
The outcome might be numerically correct.
The provenance is still defective.
This reminds us that authority provenance does not concern only who may act.
It can also concern:
who may supply evidence;
which evidence may shape which decision;
who may transform it;
which system may treat it as authoritative.
In AI-mediated institutions, epistemic authority and action authority can intersect.
A system may therefore need to preserve not merely:
what information existed,
but:
what information was authorised to count.
13. Decision authority can be distributed without becoming unintelligible
None of this means that every consequential decision needs one single human author.
Modern institutions already distribute decision-making.
A bank transaction may involve a relationship manager, fraud system, compliance team, risk policy, payment processor, and executive mandate.
A medical decision may involve a physician, laboratory, imaging specialist, protocol, insurer, pharmacist, and hospital system.
A public administrative action may involve legislation, ministerial regulation, administrative policy, a caseworker, technical systems, and judicial review.
Distributed authority is normal.
The governance failure occurs when distribution becomes unreconstructable.
Agentic systems can actually improve this.
A well-designed system may preserve authority more clearly than the human process it replaces.
It can give every agent a distinct identity.
Every delegation can be bounded.
Every authority transition can be recorded.
Every consequential action can reference the active mandate.
Every step-up approval can be timestamped.
Every revoked permission can propagate through dependent agents.
Every important effect can link to immutable evidence.
A manual organisation may operate through undocumented phone calls and remembered exceptions.
A machine-mediated system can, in principle, make delegation more explicit.
The relevant distinction is therefore not:
human decisions = accountable;
agent decisions = unaccountable.
It is:
reconstructable authority versus opaque authority.
That positive possibility matters. The purpose of authority provenance is not to make agentic systems impossible to deploy. It is to make their exercise of institutional power legible enough to audit.
14. What an authority-provenance record should preserve
The Institute’s Decision Authority Record already provides a foundation. It is designed around a bounded consequential workflow rather than an organisation’s entire use of AI and deliberately separates capability, technical permission, legitimate authority, material evidence, human control, delegation, consequences, and remedy.
For an agentic decision episode, a proportionate authority-provenance record should be capable of linking at least:
the decision episode — what consequential outcome or state change is being examined;
the principal — the human or institution on whose behalf power is exercised;
the authority basis — the law, policy, role, contract, consent, mandate, or other source;
the mandate — the outcome or task legitimately entrusted to the agent;
the agent identity — which model, agent, deployment, or service acted;
the delegation chain — who transferred what authority to whom;
the scope — permitted actions, systems, data, subjects, financial amounts, jurisdictions, or other boundaries;
the conditions — approvals, thresholds, risk states, time limits, supervision requirements;
the permissions — what the technical infrastructure actually allowed;
the material decisions — choices made inside the delegated space;
the action and consequence — what changed outside the reasoning process;
authority transitions — grants, escalation, narrowing, revocation, expiry;
human intervention — who could see, refuse, override, stop, or reverse;
the evidentiary references — logs, receipts, policy records, model/version records, approvals, hashes, and external evidence;
contestability and remedy — who can later challenge or correct the result.
The objective is not to duplicate every low-level log event inside a governance record.
The objective is to ensure that the relevant logs can be connected to the decision and authority context they cannot carry alone.
The Institute’s existing DAR specification states this explicitly: material decisions should be mapped at decision level, while voluminous telemetry can remain in external source systems referenced through stable identifiers and hashes.
15. Not every AI action needs an authority dossier
A predictable objection is that this architecture could create bureaucratic overload.
That objection is valid if provenance requirements are applied indiscriminately.
A spelling correction does not require a constitutional history of delegation.
A low-risk formatting agent does not need the same record as an agent capable of transferring money, changing a patient record, denying a benefit, deploying production code, restricting an account, or controlling industrial equipment.
The existing Synthocracy framework therefore uses materiality and proportionality rather than exhaustive documentation. Low-stakes and highly reversible activity may need ordinary logs. Moderate-risk autonomous workflows may require lightweight mandate and delegation records. High-consequence, difficult-to-reverse actions should preserve enough evidence to survive independent scrutiny.
A useful proportionality principle is:
As autonomy, material influence, delegation depth, irreversibility, and consequence increase, the quality of authority evidence should increase with them.
This keeps provenance from becoming administrative theatre.
The purpose is not maximum paperwork.
It is sufficient evidence at the point where authority matters.
16. Provenance infrastructure can itself become a surveillance problem
There is another limit.
Accountability can create new surveillance.
A system capable of reconstructing every agent, employee, instruction, approval, delegation, document, transaction, and affected person may become an extraordinarily intrusive institutional record.
Authority provenance must therefore preserve enough, not everything.
The Institute’s existing DAR principles explicitly include privacy and proportionality: personal information should be minimised, public and restricted layers separated, and accountability infrastructure should not become a new surveillance system.
This means that different audiences may legitimately receive different views.
An engineer may need trace identifiers and system metadata.
An internal auditor may require complete authority mappings.
A regulator may need access to restricted evidence.
An affected citizen may need a meaningful explanation and route to correction, but not necessarily private employee identifiers, model weights, security-sensitive logs, or confidential system internals.
The underlying evidence architecture should be capable of answering legitimate questions without assuming that radical transparency is always safe or lawful.
Accountability requires reconstructability.
It does not require universal publication of every record.
The Synthocracy Authority Provenance Test
The following is a preliminary field diagnostic for consequential human–AI and agentic workflows. It is intended for research, organisational review, and governance design rather than as a legal conformity assessment or validated certification instrument.
- Can the consequential episode be identified? Define one bounded decision or action rather than an entire AI deployment. What materially changed for a person, institution, asset, system, or external environment?
- Can the principal be identified? Which human, organisation, or legitimate authority ultimately stands behind the action? Do not substitute the immediate technical caller for the principal automatically.
- Can the authority basis be located? What law, regulation, contract, role, policy, consent, court order, administrative mandate, or other recognised basis made the exercise of power legitimate?
- Can the mandate be reconstructed? What was the agent or human actually authorised to decide or execute, and what remained outside that mandate?
- Can every material delegation be traced? If A delegated to B and B to C, can the organisation establish what authority travelled at each transition and whether each delegator possessed the right to delegate it?
- Can permission be distinguished from authority? Does a valid credential show only that the infrastructure accepted an action, or can the record also establish why the action was within the actor’s legitimate mandate?
- Can decision discretion be located? Which actor selected the supplier, classification, threshold, route, remedy, amount, recipient, or other consequential variable? Was the final actor deciding or merely executing?
- Can authority at the exact time of action be reconstructed? Were any grants narrowed, escalated, revoked, expired, superseded, or made conditional during the trajectory?
- Can human control be demonstrated rather than inferred from presence? What did the responsible human see, understand, have time to assess, possess authority to refuse, and retain capacity to change?
- Can the authority claim survive independent scrutiny? Could an auditor who does not trust the agent reconstruct principal → authority basis → mandate → delegation → decision → action → consequence, identify unresolved gaps, and distinguish claimed authority from documented or validated authority?
The central test is not:
Can we prove that an action happened?
It is:
Can we prove that the actor who caused it was entitled to exercise that particular power, under that particular mandate, at that particular moment?
17. The future audit record may need two parallel chains
As agentic infrastructure matures, a useful architecture may preserve two correlated histories.
The execution chain
Agent A → Agent B → Tool C → Service D → State Change E
This establishes what happened technically.
The authority chain
Principal H → Authority Basis P → Mandate M → Delegation A → Narrowed Delegation B → Execution Authority C → Consequential Action E
This establishes how institutional power reached the point of effect.
The two chains should reference each other.
But they should not be confused.
A break in the execution chain is a technical provenance failure.
A break in the authority chain is an accountability failure.
The emerging IETF auditing architecture already points toward this dual reconstruction by linking user intent, delegations, authorization transitions, and service-side execution records through a shared audit context. (datatracker.ietf.org)
This may become one of the foundational infrastructure problems of agentic governance.
The future agent ecosystem will generate enormous quantities of telemetry.
The scarce resource may not be data.
It may be meaningful evidence about who was entitled to cause what happened.
18. From observability to answerability
There is a final distinction worth preserving.
Observability asks whether the system can be seen.
Auditability asks whether its operation can be reconstructed and tested.
Traceability asks whether relevant events and transformations can be followed.
Provenance asks where those elements came from and how they relate.
Answerability adds the institutional question:
Who must explain and defend the exercise of power?
A company can become extraordinarily observable while remaining weakly answerable.
It can possess dashboards showing every agent action while nobody can say which executive, policy owner, public authority, professional, principal, or other institution actually owned the consequential discretion.
This is why the Institute’s research should not stop at better logs.
The goal is an evidence architecture in which technical observability can support institutional answerability.
The machine record should eventually make it possible to say:
This was the principal.
This was the mandate.
This was the agent.
This was the authority it received.
This was the part it delegated.
This was the decision it made.
This was the action that followed.
This was the human who could intervene.
This was the authority in force when the consequence occurred.
This is who can now answer for it.
That is a much stronger claim than:
“We have the logs.”
Conclusion — Logging the action is not the same as proving the decision
The agent age is producing a paradox.
Our technical ability to observe machine actions is improving rapidly just as the institutional authorship of those actions is becoming more distributed.
Congress is proposing machine-readable agent inventories and tamper-resistant logs. NIST is developing work around agent identity, authorization, auditing, and non-repudiation. IETF contributors are designing architectures that preserve delegation context and changing authorization across system boundaries. Researchers are proposing signed mandates, delegation receipts, and agent-aware observability. China’s 2026 WAIC statement explicitly places defined agent decision-making authority alongside behavioural boundaries, tracing, and risk alerts. (lawler.house.gov)
These are important advances.
But the central accountability problem remains deeper than event recording.
An event log can prove that Agent C invoked payment.execute.
It cannot automatically prove that:
the original principal authorised the payment;
the relevant mandate covered that transaction;
Agent A possessed delegation authority;
Agent B remained inside its scope;
Agent C possessed discretion rather than mere execution authority;
the authority had not expired;
the human reviewer possessed meaningful control;
or the institution could legitimately exercise the power represented by the transaction.
This is why the next layer of agent accountability must connect technical provenance to authority provenance.
The distinction can be reduced to three sentences:
A log can prove that an action occurred.
Decision provenance can show how the outcome was produced.
Authority provenance must show why the actors who produced it were entitled to exercise that power.
As AI moves deeper into administration, finance, employment, healthcare, infrastructure, commerce, cybersecurity, and other consequential domains, this difference will matter increasingly.
The central question of the agent era is therefore not only:
What did the machine do?
Nor even:
Which machine did it?
It is:
Who authorised whom to decide what could happen next—and can we still prove that chain after the consequence has occurred?
If we cannot, we may possess perfect evidence of execution while losing the most important evidence of governance.
