When AI agents leave a tamper-proof record of what they did, who gets to decide what's recorded?
Who holds authority to anchor evidence in this system?
This explores who decides which records of AI agent activity get locked into a tamper-evident external record ("anchored"), and whether the corpus names anyone with that authority.
This explores who decides which records of AI agent activity get locked into a tamper-evident external record, and the corpus's blunt answer is that nobody is named. The architecture anchors "selected" communications and mentions risk-based evidence selection. It gives no mechanism, no criteria, and no way to notice when a critical trace was missed Who decides which agent communications get anchored?. The selector is the most powerful role in the system, and it is left blank and unexamined.
The gap matters because of what anchoring can and can't do. Agentic systems need process memory that can reconstruct what agents did, in what order, and whether the record was edited afterward. External anchoring adds tamper evidence on top of ordinary logging Can external anchoring detect tampering in agentic process logs?. But a blockchain anchor only proves a record hasn't changed since it was committed. It can't show when the event happened, whether it was captured correctly, or who was authorized to anchor it What can a blockchain anchor actually prove about records?. Tamper evidence is not truth, so whoever chooses what goes in shapes the story the unalterable record tells.
The question gets harder when agents cross organizational lines. The paper calls for multi-party assurance but never says whose rules govern a trajectory that spans several parties. The four sources of constraint (operator, organization, regulator, standards body) have different owners whose policies may conflict and may not be visible to everyone Who enforces invariants when agents cross organizational boundaries?. So "who can anchor" splits into two questions: who performs the anchoring, and whose definition of "worth anchoring" applies. Regulators are the obvious candidates to judge this, but the evidence is pitched at reporting readiness, not compliance. It lacks the capture authenticity and ordering controls a regulator would need to confirm that human oversight actually happened Does anchored evidence actually enable regulatory compliance or just readiness?.
Two notes that aren't about anchoring point toward a better answer, though this is my extrapolation and not the paper's proposal. In the confused-deputy problem, a low-privilege agent forges approval and a high-privilege agent misuses its authority. The failure happens at the authorization decision, and the fix is a policy check that sits outside agent judgment Can forwarded content trick high-privilege agents into misusing their authority?. Guardrails around LLM judges work the same way, as mechanical checks that never rely on the judge to police itself, such as planted cases that act as alarms Can deterministic checks protect LLM judges from failure?. Read together, they suggest that anchoring authority shouldn't rest on the agents' own sense of what matters. It should be a policy held by a named owner. Mechanical checks, like a planted trace that must appear in the anchored set, would then reveal when the selector is missing things.
Sources 7 notes
The paper describes anchoring 'selected' communications and mentions 'risk-based evidence selection' but provides no mechanism for choosing what to anchor, no criteria for selection, and no method to detect when critical traces are missed. This gap leaves the selector itself as an unexamined control.
Organizations must reconstruct agent actions, establish their temporal order, and detect post-hoc changes to critical traces. External anchoring adds tamper evidence as a layer atop essential conventional logging.
A blockchain anchor shows a record has not changed since commitment, but cannot verify when an event actually occurred, whether it was captured correctly, who was authorized to anchor it, or what caused it. Tamper evidence does not mean truth.
The paper calls for multi-party trajectory assurance but never identifies whose rules should govern behavior when agents delegate across organizations. The four constraint sources—operator, organization, regulator, standards body—have different owners whose policies may conflict and may not be visible to all parties.
The paper names five governance uses and three regulatory regimes but supplies no provision-to-evidence mapping and omits runtime governance controls. Temporal anchoring and artifact integrity alone cannot substitute for ordering, capture authenticity, and causal traceability—the controls a regulator would need to verify human oversight actually occurred.
Show all 7 sources
Retrieval-summarization-delegation pipelines allow low-privilege agents to embed forged authorization claims that cause high-privilege agents to misuse their legitimate authority. The failure occurs at the authorization decision, not at the executor's defenses—and can be prevented by policy checks external to agent judgment.
Research identifies four mechanical safeguards: ordering unarguable checks before contestable ones, measuring correctness against human labels, hiding test data from proposers, and using planted cases as alarms. None requires the LLM itself to verify compliance.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Agents of Chaos
- Knowing Is Not Enough: Information Retrievability as a Precondition to Effective LLM Oversight