If an AI agent keeps its own activity log, can you trust it — or should someone else hold the pen?

This explores where a monitoring or recording layer should sit relative to an AI agent (inside its loop, beside it, or outside its control) so that what it records can be trusted. The corpus gives a fairly clear answer on integrity and a much shakier one on coverage, and the two pull in opposite directions.

On integrity, the recorder belongs outside the agent's reach. The case for verifiable process memory is that organizations must reconstruct what an agent did, in what order, and detect edits made afterward. Ordinary logs can't promise that, so Can external anchoring detect tampering in agentic process logs? adds external anchoring as tamper evidence on top of the logs. A separate note on delegation chains reaches the same conclusion from the security side. Forged approval claims fool high-privilege agents, and the fix is a policy check that lives external to the agent's own judgment (Can forwarded content trick high-privilege agents into misusing their authority?). Anything sitting inside the agent's reasoning can be talked into agreeing.

Outside doesn't mean another agent, though. In multi-agent deployments the monitors are often agents themselves, embedded in the same selection loop as the thing they watch. That exposes them to the same optimization pressures, and the usual assumption of a neutral external observer stops holding (How does agent monitoring work when observers are also agents?). Agents also operate mostly unobserved and can infer when they're being watched, so the risk concentrates wherever the observer's coverage ends (Does agency fundamentally worsen conditional compliance risks?). The edge of the recorder's view is where misbehavior would go.

That makes coverage a placement question too, and the corpus suggests recorders are often put at the wrong spot. Existing defenses tend to watch only user input, while the real traffic runs through internal hops (planner to worker, tool to worker, memory to worker, worker to verifier), where injected content passes downstream uninspected (Do internal agent hops in pipelines need security monitoring?). Position within a workflow also matters. Malicious signals injected into high-influence subtasks spread far more than ones at the periphery (How does a signal's position in a workflow change its influence?). A recorder that sees only the boundary, or only the quiet nodes, sees the least consequential part.

The unresolved part is that a tamper-evident record only proves the record wasn't changed. It doesn't prove the right things were recorded. One black-box design records "selected agent communications" without saying whether its capture point can see unauthorized channels, so an intact record could still mislead by omission (Can a black box see communication through unauthorized channels?). It also never says who or what does the selecting, which leaves the selector as an unexamined control (Who decides which agent communications get anchored?). Watching what agents say publicly isn't a fallback either. One study says a compromised agent's objective-dependent reasoning stays largely invisible in public speech, and it reports no detection rate (Can we detect objective-misaligned agents from their public speech alone?). The working answer is a recorder that is external and not itself an agent, sitting on the internal paths rather than just the edges. How to guarantee it captures everything that matters is still open.