How can we monitor AI agents without enabling mass surveillance?

Chan and colleagues' paper "Visibility into AI Agents" argues that governing increasingly autonomous AI agents requires "visibility" — information about "where, why, how, and by whom certain AI agents are used" — and proposes three categories of measures to produce it: agent identifiers, real-time monitoring, and activity logs. Agent identifiers "indicate whether and which AI agents are involved in an interaction," extending watermarking schemes to cover not just text, image or audio outputs but "the use of external tools and services" as well. Real-time monitoring is meant to "flag problematic agent behaviour as it happens," while activity logs "record certain inputs and outputs of agents so as to enable in-depth, post-hoc analysis of behaviour" after the fact.

The paper's reasoning starts from what makes agents different from other AI systems: because an agent can take "multiple consequential actions in rapid succession" with a human out of the loop, harm can accumulate "before a human notices," and the agent's task performance is "less limited by the expertise of its user" than when a human must guide or take the action themself. The three measures are pitched along two axes the authors name explicitly — "intrusiveness of data collection and informativeness of the data" — and are meant to work whether an agent is deployed by one centralized provider or spread across a decentralized "spectrum" of hardware and software suppliers, where a compute provider becomes an alternate point of visibility when the deployer itself is diffuse.

The paper qualifies its own prescription on the privacy side: because "a handful of compute providers dominates the market," any visibility measure built on compute-provider monitoring would mean "monitoring users of those providers would [be] equivalent to monitoring much of society," so the authors argue access should scale by "granularity" (aggregated, de-identified, or identifiable) and "quantity" (full, filtered, or upon-request) rather than defaulting to maximal logging. This sits alongside How do agent security layers connect across the stack?, which maps the broader stack these visibility measures would need to plug into, and against Does AI augmentation protect workers from skill erosion?: Chan and colleagues name the same overreliance dynamic — "stopping the agent may be difficult if doing so would lead to cascading failures" — as a reason visibility infrastructure is needed up front, rather than treating oversight erosion only as an outcome to measure after deployment.

The paper is explicit that it does not establish that these measures work or should be adopted: it states its aim is "rather than advocating for immediate implementation," and that even comprehensive visibility "is not by itself sufficient," since "those harmed by [agents] may not have the power to intervene and reduce risks." The excerpt offers a design space for what to collect about agents, not evidence that any of the three measures reduces harm in practice, and it leaves open who would be positioned to act on the information once it exists.