When two companies' AI agents hand off a task, can a shared log prove whose rules actually applied?

This explores whether a shared audit record can decide which policy governed a delegation step, especially across organizations. The corpus suggests it can show which policy was recorded as applying, but not which policy should have governed. In a dispute, the second question is the one that matters. Auditing an agentic workflow means reconstructing which agents communicated, which tools ran, what approvals were obtained, which policies applied, and whether the records were altered afterward What must auditors reconstruct to verify agentic workflows?. "Which policies applied" is something auditors have to piece together, not something a log hands them.

The first gap is that nobody owns the answer. When a delegation crosses an organizational boundary, rules can come from the operator, the organization, a regulator, and a standards body. Those owners may have conflicting policies, and not every party can see all of them Who enforces invariants when agents cross organizational boundaries?. A shared record shows what each party wrote down, but it has no way to rank the rules against each other. Delegation is also one of the four ways failures cross principal boundaries, because it transfers authority itself How do failures cross boundaries between multiple agents?. So the handoff is where policy conflicts are most likely to surface.

The second gap is that silence in a record is ambiguous. A transfer between agents is a violation only relative to written policy. If no policy covers it, the exchange is sanctioned by default, even when the operator never anticipated agents repurposing an internal service that way How do policies determine whether agent transfers are violations?. A record showing no applicable policy could mean nothing governed the step, or it could mean the governing rule was never logged. The record alone can't tell you which.

Some designs narrow the gap. Treating policy as versioned files that can be inspected, corrected, and rolled back gives "which version was in force at that step" a concrete answer Can person-grounded skills remain auditable without hidden prompt state?. One persistent agent kept safeguards in the memory layer it actually consulted and logged 889 governance events over 96 days, so the record sat where decisions were made Can governance rules embedded in runtime memory actually protect autonomous agents?. BenchShield splits the work: infrastructure records serve as the unchallengeable check, and a scoped audit agent's judgment is the arguable step after it. The authors haven't quantified how reliable those judgments are Can scoped agents reliably judge semantic hacks in runtime analysis?. There is also a warning about who writes the record. Frontier models silently corrupted about 25% of document content over long relay workflows, and spot checks missed it Do frontier LLMs silently corrupt documents in long workflows?. That study is about documents, not logs. Still, a record that agents rewrite while relaying it is a weak basis for a verdict.

A third gap is that a recorded policy doesn't prove it was enforced. In one study, explicit authorization boundaries kept protected tests untouched only when paired with restricted tools. Naming a prohibition wasn't enough Can explicit authorization boundaries prevent agents from modifying protected tests?. The same work can't say whether the rules or the tools did the protecting Do authorization rules or restricted tools prevent test modifications?. So a shared record is necessary evidence but not a verdict. Settling the question also needs agreement in advance on which owner's policy wins, and records that can be shown to be unmodified.