What must auditors reconstruct to verify agentic workflows?

The introduction puts the shift in one sentence: "It is no longer sufficient to ask what a human decided or what an application logged." What organizations "may need to establish" instead is "which agent communicated with which other agent, which information was exchanged, which tool was invoked, what human approval was obtained, which policy applied, and whether the record of those steps was later modified." The abstract's list is close to it: what happened, when, which agent or human was involved, which control or policy applied, and whether records were modified afterwards.

The reasoning is about what the old questions assumed. An audit built on "what did a human decide" assumes a decision-maker, and one built on "what did the application log" assumes a single system of record. An agentic workflow breaks both. The actors include agents talking to each other, the steps include tool calls, and the human enters as an approval at some point in the chain. So the evidence question becomes a join across parties: who exchanged what with whom, under which policy, approved by whom. The last item is different in kind. "Whether the record was later modified" is a question about the evidence and not the events, and it is on the list because the other five answers cannot be trusted without it.

That makes this the audit-side twin of Can step-by-step approval miss harmful behavior patterns?. If a rule binds a sequence, then testing it after the fact needs the sequence in the record, with the links between steps. The pairing is the vault's reading. The paper does not cite the trajectory argument.

Two cases from other papers press on the list from different sides. Can a correct outcome hide protocol violations in multi-agent systems? has verifying agents return the correct verdict while skipping the required log check, so what a verifier decided is satisfied and whether the required control ran is not. That excerpt does not say how the skip was found, and the black-box excerpt reports no record that would have shown it. The other pressure is on scope. The six questions are asked of one workflow, while Should defence units span multiple executions and agents? argues that an assessment may need a linked set of actions across executions that need not overlap. Two of the episode's three links line up with the list, observed transfers with which information was exchanged and task authority with which policy applied, and response history has no counterpart in it. Whether the list would find a transfer through a shared store between separate executions is not stated. The mapping is mine.

The list is framed as what organizations "may need," not as requirements the paper derives. The excerpt gives no event schema, no count of parties, and no account of how the six questions map to records. It also does not consider that the party who must reconstruct may never have been in the workflow, the case in Who actually bears the risk when multi-agent workflows fail?.