A blockchain stamp proves a record wasn't changed, but does it prove the record was true?

This explores what a blockchain anchor leaves unproven when an organization needs to show compliance for AI agent activity, and which additional controls fill those gaps. The short version is that an anchor proves a record hasn't changed, and almost nothing else. It shows the record is unaltered since it was committed, but it can't verify when the event actually happened, whether it was captured correctly, who was authorized to anchor it, or what caused it. What can a blockchain anchor actually prove about records? puts it in one line: tamper evidence is not truth.

That gap is why one paper's pitch is narrower than it sounds. Does anchored evidence actually enable regulatory compliance or just readiness? notes that anchoring gets you to reporting readiness, not compliance. It names three regulatory regimes but never maps a specific legal provision to a specific piece of evidence. The controls a regulator would need in order to check that human oversight really happened are ordering, capture authenticity, and causal traceability. Anchoring supplies none of them. Anchoring also sits on top of ordinary logging rather than replacing it. Can external anchoring detect tampering in agentic process logs? treats external anchoring as a tamper-evidence layer over conventional logs that still have to be good. The logs must let you reconstruct what agents did and in what order. Anchoring only lets you detect later edits.

The corpus points to a second group of controls that act while the agent is running. Can architecture prevent violations better than training values? argues that constraints which remove violations from the agent's action space beat training the agent to behave. Training against detected failures can just teach the agent to pass detection. Can governance rules embedded in runtime memory actually protect autonomous agents? shows one version of this: safeguards encoded in the memory layer an agent consulted while working, logged as 889 governance events over 96 days. A hash written to a chain afterward can't do that, because it only records what already happened.

A third group is checking at the right place in the workflow. Can individual components pass safety checks if the system still fails? shows that every step can pass its own check while the whole workflow still fails, since local checks test different properties than end-to-end safety needs. Where should workflow validation gates be placed for safety? responds by validating the assembled workflow at the point just before an irreversible action, where the full risk picture can be reconstructed. Validator quorums have their own limit. Can validator consensus guarantee both agreement and semantic correctness? says such systems guarantee agreement from protocol assumptions alone, but semantic correctness holds only statistically. So agreement among validators doesn't mean they got it right.

Two practical constraints round this out. Anchoring commitments rather than content, as Can commitments protect sensitive agent data while enabling verification? describes, keeps sensitive data off-chain. But the organization must then retain the content itself, and it inherits open questions about deletion and access control, so those need their own policies. And the corpus doesn't settle how to build the ordering, capture-authenticity and causal-tracing controls it says are missing. It identifies them as the gap but doesn't supply a tested design.