A passed agent run shows that a recorded execution path completed; it does not, by itself, prove the action was allowed. To substantiate authorization, connect the initiating identity and delegated authority to the exact action, a policy decision made before execution, any required approval, the execution event, and an independently observable result. The evidence should make clear which of those links it actually establishes.
What does a passing run actually establish?
A success status or agent-generated trace can be evidence that some recorded path completed. It does not establish that a policy gate existed before the action ran, that the action matched an approval, or that the claimed result occurred in the destination system.
As an Amazon Associate I earn from qualifying purchases.
The IETF Internet-Draft on this subject draws an important timing distinction: a post-execution log documents what happened but cannot prove that a policy gate existed before the action ran. The draft is work in progress, not a finalized standard, but the distinction is useful when evaluating any audit trail.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep four events separate: what the agent proposed, what the policy system decided, what the runtime executed, and what effect was observed. A model request is not proof that a command ran, and a runtime success message is not necessarily proof of the downstream effect.
#1 Best Overall
What evidence chain makes authorization reviewable?
Review the run as a set of linked records. Each record supports a particular claim; none should be treated as proof of the whole chain on its own.
| Evidence layer | What to capture | What it helps establish |
|---|---|---|
| Initiator and authority | Original request or task reference; human or service initiator; agent identity; represented subject or delegated role; granted scope and validity period. | Who initiated the work and what authority the agent was meant to exercise. |
| Proposed action | Operation, target tool, resource, arguments or action digest, and tool-schema version. | What specific operation was presented for authorization. |
| Policy decision | Policy rule and version; decision identifier and time; scope; outcome and reason where available. | Which rule was applied, and whether the result was allow, deny, or approval required. |
| Approval, if required | Approval request and final approval identity, time, and scope. | Whether the required person or process approved the action covered by the request. |
| Execution and effect | Runtime event and result, followed by a destination-system receipt or resulting artifact. | Whether the authorized action was executed and whether the claimed effect is independently observable. |
| Correlation and custody | A stable run or correlation identifier mapped to native identifiers from the orchestrator, policy engine, runtime, credentials, commands, artifacts, and platform; record export, access controls, and collection-failure monitoring. | Whether records refer to the same run and whether the evidence could have been omitted or altered by the agent itself. |
Keep credential values out of logs. Redact sensitive prompts and outputs when they are not needed for review, restrict access, monitor collection failures, and set retention by data class. Northflank’s audit guidance emphasizes these controls while noting that platform logging does not itself establish an agent’s decisions, tool calls, or business-level results.
How do you check whether permission covered the action that ran?
Compare the authorization record with the operation at the execution boundary—not merely with the run name or a broadly similar request. Microsoft’s Agent Governance Toolkit protocol models an action using the agent, represented subject, operation, target tool and schema version, resource, and parameters. It specifies an action digest that the execution boundary recomputes from the action about to run. As the protocol puts it, “An approval for one binding cannot authorize another.”
- Reconstruct the executed action. Obtain the runtime’s actual tool, target, resource, arguments, and schema version rather than relying only on the model’s proposed call.
- Match it to the decision. Check that the policy decision or its digest binds to those same details. A changed target or argument may mean the earlier approval does not apply.
- Check the timing. Compare timestamps from the policy decision, approval where applicable, and execution. Confirm that the authorization happened before the operation and that the execution boundary enforced it.
- Check authority and scope. Confirm that the identity and delegated role had the required scope at that time, and that any approval was by the required approver for that action.
- Corroborate the result. Match the execution event to a receipt or artifact from the destination system when available. A runtime’s own success status may not establish that the destination changed as claimed.
- Check record coverage. Verify that native event identifiers map to the same run, and establish whether evidence was exported or protected from alteration by the agent being audited.
The Microsoft protocol is project documentation, not proof that a particular deployment implements its controls. Verify the behavior of the system under review rather than inferring it from a protocol description.
Rank #3
What can logs, hashes, signatures, and attestations prove?
These mechanisms support different claims and should not be collapsed into a single assertion that a run was “proven.” A log records events it captured. A hash can support an integrity check against a known value. A signature can identify a signer. An external anchor can support evidence that a record existed by a particular point in time. None of those properties alone proves that the record is semantically true, that the action was authorized, or that all relevant events were captured.
The September 8, 2026 evidence-model working paper separates artifact integrity, temporal existence, provenance, approval evidence, declared ordering, capture claims, relevance, monitoring, and policy assessment. It also says its conceptual model does not validate a specific implementation, prevent every failure, or automate legal compliance. Treat those as distinct review questions rather than assuming one cryptographic control answers them all.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How strong is the supporting guidance?
The IETF text is an Internet-Draft, not a finalized RFC. Microsoft’s action-binding protocol describes an approach, but does not show that a particular deployment follows it. The evidence-model working paper and the April 2026 preprint Proof of Execution: Runtime Verification for Governed AI Agent Actions are proposals, not certifications or independent production validations.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe April preprint proposes separating planning, enforcement, effect, and recordkeeping, with an attestation object connecting authorization, enforcement, durable effect, tamper-evident history, and replay context. Its reported prototype measurements are author-reported results, not general performance guarantees; they do not demonstrate that another implementation is secure or complete.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
