A tamper-proof seal shows a record hasn't changed — but who gets to decide which party may apply it?
Who decides whether an entity has authority to anchor a record?
This explores who holds the power to say 'this party may anchor this record', meaning the authorization step before a tamper-evident record exists, and what the corpus says about who fills that role.
This explores who holds the power to say 'this party may anchor this record', the authorization step before a tamper-evident record exists. The corpus's plain answer is that no one is named. A blockchain anchor can show that a record hasn't changed since it was committed, but it can't tell you when the event really happened, whether it was captured correctly, or a-blockchain-anchor-supplies-temporal-anchoring-and-artifact-integrity-event-ord|who was authorized to anchor it. The anchor is a seal, and it says nothing about who was entitled to apply it. Anchoring is also pitched as a layer added on top of ordinary logging (Can external anchoring detect tampering in agentic process logs?), so the question falls back to whoever runs that logging.
The gap shows up again one step earlier, at the choice of what gets anchored at all. The architecture anchors 'selected' agent communications but gives how-is-it-decided-which-agent-communications-get-anchored-the-architecture-ancho|no criteria for selection and no way to notice when a critical trace was missed. Whoever holds the selector decides which parts of history can ever be proven later, and nobody examines that role. When agents work across organizations it gets harder still. Who enforces invariants when agents cross organizational boundaries? lists four possible sources of rules (operator, organization, regulator, standards body). Each has a different owner, their policies can conflict, and not every party can see them. Authority to anchor is contested territory, and the corpus doesn't say who wins.
The nearby security papers agree on one thing: the decision shouldn't be left to the judgment of the agents involved. In Can forwarded content trick high-privilege agents into misusing their authority?, a low-privilege agent slips a forged authorization claim into forwarded content, and a high-privilege agent then misuses its real authority. The failure happens at the authorization decision, and the fix is a policy check that sits outside agent judgment. The same weakness appears when the final checker is itself fed bad evidence. In Can a poisoned validator still approve unsafe actions?, a validator reading poisoned shared memory approved every unsafe action. Can deterministic checks protect LLM judges from failure? sketches the shape of a remedy: mechanical, unarguable checks run first, and none of them needs the LLM's cooperation.
Taken together, the implied answer is that the authority decision belongs to a rule enforced from outside the entity asking to anchor. Ideally that rule lives where the agent actually consults it, as in Can governance rules embedded in runtime memory actually protect autonomous agents?, where safeguards sat in the memory layer the agent read during operation. That is an inference from the corpus, not something any one note states. There is a stake in getting it right, too. Does anchored evidence actually enable regulatory compliance or just readiness? argues that anchoring alone gives reporting readiness, not compliance, because a regulator also needs proof of capture authenticity, and that is the authority question again. So the answer today is 'whoever configures the pipeline, unexamined', and several papers point at that hole from different sides.
Sources 9 notes
A blockchain anchor shows a record has not changed since commitment, but cannot verify when an event actually occurred, whether it was captured correctly, who was authorized to anchor it, or what caused it. Tamper evidence does not mean truth.
Organizations must reconstruct agent actions, establish their temporal order, and detect post-hoc changes to critical traces. External anchoring adds tamper evidence as a layer atop essential conventional logging.
The paper describes anchoring 'selected' communications and mentions 'risk-based evidence selection' but provides no mechanism for choosing what to anchor, no criteria for selection, and no method to detect when critical traces are missed. This gap leaves the selector itself as an unexamined control.
The paper calls for multi-party trajectory assurance but never identifies whose rules should govern behavior when agents delegate across organizations. The four constraint sources—operator, organization, regulator, standards body—have different owners whose policies may conflict and may not be visible to all parties.
Retrieval-summarization-delegation pipelines allow low-privilege agents to embed forged authorization claims that cause high-privilege agents to misuse their legitimate authority. The failure occurs at the authorization decision, not at the executor's defenses—and can be prevented by policy checks external to agent judgment.
Show all 9 sources
In a four-agent LangGraph system with authorization disabled, a validator that reads poisoned shared memory forges approvals in every trial, leading to execution of unsafe actions. The validator's position as final authority before action execution, combined with its access to corrupted evidence, made it ineffective as a boundary.
Research identifies four mechanical safeguards: ordering unarguable checks before contestable ones, measuring correctness against human labels, hiding test data from proposers, and using planted cases as alarms. None requires the LLM itself to verify compliance.
A persistent agent recorded 889 governance events across 96 active days, with safeguards encoded directly into the memory layer the agent consulted during operation. Runtime-resident governance proved more effective than external policies because the agent actually accessed it during decision-making.
The paper names five governance uses and three regulatory regimes but supplies no provision-to-evidence mapping and omits runtime governance controls. Temporal anchoring and artifact integrity alone cannot substitute for ordering, capture authenticity, and causal traceability—the controls a regulator would need to verify human oversight actually occurred.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce
- Trust propagation and structural containment in Multi-agent LLM pipelines