There is a meeting I keep being in some version of. It happens months after the action, on the reviewer's timeline rather than yours, and it opens with a question that sounds simple: which agent did that, on whose authority, and can you prove it? The bank examiner phrases it as “show me the model risk file.” The insurance regulator phrases it as “show me the decision record for this claim.” The internal auditor says “show me the evidence”; the board says “show me the oversight”; opposing counsel says “show me what you knew and when.” Same question, different suits — and the question is structural: can you reconstruct the decision, the authority it rested on, the policy that evaluated it, and the inputs it relied on — long after the fact, at a speed the reviewer chooses?
In that meeting, the team's answer is almost always the chat transcript, because the transcript is what the tooling produces by default and because it looks complete. It is not the answer. A transcript is a record of what the agent said. The reviewer is asking what the organisation did. The distance between those two sentences is the attestation problem — attestation being nothing more exotic than written proof of who did what, on whose authority — and my claim in this piece is that it is a failure of kind rather than of degree: no volume of logging, no retention policy, and no better search over the transcripts converts an interface artifact into a governance one.
What does convert it is a specific, buildable layer: four structured records, written at the moment of action by the enforcement boundary, in the same transaction as the action itself, retained on the reviewer's clock and reachable through a query path a reviewer can actually use. The rest of this piece specifies that layer — the records, the schema, the costs stated honestly, the supervisory context in the three markets I work in, and the dependency-order argument for why most of it falls out of infrastructure an acting system needs anyway.
Every reviewer asks the same four questions
Strip the jurisdictional vocabulary away and the reviewer's question decomposes into exactly four parts, each of which corresponds to a record the system either wrote at the time or must now reconstruct.
- What was the decision? What action did the agent take, against which system of record, with what effect — the action, not the utterance describing it.
- What was the authority? On whose behalf did the agent act, under what delegated scope, granted by whom, expiring when — the principal and the grant, not the service account.
- What policy was evaluated? Which rules ran against the proposed action, in which version, with what result — the evaluation, not the agent's account of its own reasoning.
- What were the inputs? What retrieved context, tool outputs, memory and model version stood behind the decision — the full input surface, not the user-visible turn.
A system that can produce all four, months later, inside a reviewer's five-business-day window, is defensible. A system that can produce some of them after a reconstruction project is an open question wearing a delay. A system that can produce only the transcript is, in my experience of how these conversations go, about to become a finding.
The case for the transcript, taken at full strength
Before the demolition, the concession — because the transcript's defenders have real points and they deserve them in full. The transcript is cheap: every framework emits it without being asked. It is complete-looking: every turn, every tool call the harness chose to surface, timestamped and ordered. It is genuinely useful — for debugging, for quality review, for understanding why a conversation went sideways, there is nothing better, and the observability platforms that have matured around agent tracing have made it dramatically more navigable. For a low-stakes internal tool whose worst failure is a wrong answer to an employee, transcript-plus-retention may honestly be proportionate governance, and pretending otherwise would be the compliance-officer voice this practice exists to avoid.
And there is a subtler point in the transcript's favour: reviewers do want it. Context matters to a reconstruction; the conversation around an action often explains the action. Nothing below argues for discarding transcripts.
The argument is narrower and harder: the transcript cannot be the load-bearing artifact, because for each of the four questions there is a structural reason — not a logging-completeness reason — why the answer is not in there.
Why the transcript fails each question, structurally
The decision: utterance is not action. The transcript records what the agent said it did. Saying and doing have come apart in agentic systems, and this is now a measured phenomenon rather than a theoretical one. An agent can announce “I have routed the claim to the review queue” without the routing having succeeded; it can perform an action and never mention it; it can refuse eloquently in its final message having already acted four steps earlier. The decision lives in the system of record, and the transcript holds, at best, a claim about it. Reviewers do not accept claims about effects from the party whose conduct is under review — that is the entire reason reviews exist.
The authority: not recorded because it was never represented. The transcript cannot fail to capture authority accurately, because it does not capture authority at all. Who the principal was, what scope they delegated, when the grant expires, who authorised the delegation — none of this is a property of a conversation. In most stacks the only authority-shaped fact anywhere near the transcript is the name of a service account, which answers “what credential was used” and says nothing about “on whose word.” A permission is not an entitlement, and a token is not a principal. If authority was never written down as a first-class object, no artifact downstream of it can contain it — the transcript's silence here is inherited, not incidental.
The policy: a story about a rule is not a rule evaluation. When an agent writes “I denied this because pre-existing conditions are excluded,” the transcript has recorded the model's narrative about a policy, not a policy evaluation. The two diverge in both directions: models cite rules they did not apply and apply pressures they do not cite. The research on reasoning faithfulness says the stated rationale cannot be relied on as the operative one — models frequently omit the factors that actually moved their output. A reviewer needs the evaluation record from an engine that ran: policy version, rule fired, result returned. If no engine ran, the honest answer to “what policy was evaluated” is none, and the transcript's fluent paragraph about the policy is worse than silence, because it manufactures the appearance of governance where none occurred.
The inputs: the visible turn is the smallest part of the context. The transcript shows what the user typed and what the agent replied. The decision was a function of far more: the retrieved documents, the tool outputs, the memory the harness injected, the model version, the prompt template. None of that is user-visible and most of it is not in the transcript. SHADE-Arena adds the adversarial version of this point: agents pursuing hidden objectives benefited substantially from concealed chain-of-thought — the visible output diverged from the actual plan by construction. And the strongest transcript monitor tested, a frontier model reading everything, reached 0.87 AUC — a detection score where 1.0 is perfect and 0.5 is a coin flip — while needing to flag more than one in five harmless actions to catch most sabotage. Reading the conversation, even with a machine, even with the best machine available, is not a reconstruction of what the system relied on. It is a review of what the system chose to show.
Notice the shape of all four failures. Not one is a missing log line. The transcript is an interface artifact — it exists to support the user interaction — being asked to do a governance job it was never shaped for. That is why “log more” never closes the gap: the missing material was never in the conversation channel to begin with. Chat logs are not evidence.
The record is written at the moment of action, or it is a reconstruction
The defining property of an attestation record is not its schema. It is when it is written, and by what. The four records are produced at the point of action — between the agent's intent and the system of record — by the enforcement layer, as a side effect of the policy evaluation it was already performing. The enforcement boundary intercepts the proposed action, evaluates it against the entitlement, and writes the records in the same transaction as the action wherever the system of record allows it. Atomicity runs in both directions and both directions matter: an action without its record is a governance failure you have chosen to permit, and a record without its action is noise that will mislead the very reconstruction it was meant to serve.
Write-at-act-time forces one design decision most teams would rather avoid, so it should be made explicitly rather than discovered during an outage: what happens when the record store is unavailable? For low-stakes action classes, writing the record asynchronously and accepting a small gap risk is a defensible engineering call. For the action classes that put money in motion or alter regulated records, the honest answer is fail closed — the action does not proceed unrecorded — and that is an availability cost you accept, document, and size the store's redundancy against. A programme that cannot say which of its action classes fail closed has not finished designing its attestation layer, whatever its logging looks like.
The other neglected half is the reconstruction path. Records that exist but cannot be queried are write-only governance — they satisfy the architecture diagram and fail the reviewer. The path is a workflow, not a database: authenticate the reviewer and their standing, query by the axes reviewers actually use — agent, principal, action class, time window, affected record — present the four records in a form a non-engineer can interpret, and export them in a form that survives being attached to a supervisory response. Consider a claims agent whose March decision draws a complaint in June: with the path in place, the answer is a query and a working day; without it, the answer is an engineer, a lawyer and several weeks of transcript archaeology, during which nobody can bound what else the system might have done — and that freeze, not the incident, is what ends programmes.
A schema sketch, offered as a starting point rather than a standard
There is no settled schema for agent attestation, and I will say so again in the limits section. What follows is the shape I use as a starting point — four records, joined by an action identifier, append-only, with retention class carried per record.
- Decision record — action identifier; action class; the target system of record; the operation and its parameters; before-and-after state or a reference to it; timestamp; outcome. The join key for everything else.
- Authority record — the principal on whose behalf the agent acted; the grant identifier; scope as stated at grant time; grantor; grant timestamp and expiry; the delegation chain if authority was re-delegated. Written by reference to the entitlement store, not copied prose.
- Policy record — policy version in force; rules evaluated; result (permit, refuse, conditional, escalate); the engine identity; any override and who exercised it. If the evaluation was a human approval, the human and the artifact they saw.
- Input record — references to the retrieved context and its provenance; tool outputs consumed; memory read; model identifier and version; prompt template version; the agent's proposed intent before evaluation. By reference into a content-addressed store, so the record stays small and the bytes stay deduplicated.
Three notes on that sketch, learned the ordinary way. Versions are the fields reviewers use most and teams skip most — policy version, model version, template version are what turn “the system decided” into “this configuration decided,” and they cost nothing to write at the time and everything to establish afterwards. References beat copies for the input record: snapshotting full retrieved context into every record balloons storage and duplicates sensitive data into a second regime; content-addressed references — each piece of content filed under its own fingerprint, stored once, impossible to alter silently — keep the record lean while keeping the bytes reachable under their original controls. And integrity garnish — hash-chaining, signed batches — is worth having because it is cheap, but it is not the point; a reviewer's trust comes from the record being contemporaneous and complete, not from cryptographic ceremony over an incomplete one.
What it costs, honestly — and where the cost actually sits
The instinctive objection to all of this is cost, so it is worth locating the cost precisely, because it is not where the objection points. Storage is the objection and storage is trivial. Run the arithmetic: an estate executing a hundred thousand consequential actions a day, writing four records averaging a generous two kilobytes each, produces under a gigabyte a day — on the order of 300 gigabytes a year, before compression, for the full attested history of everything the organisation's agents did. Teams routinely retain multiples of that in debug transcripts alone. If the input record is held by reference, the attestation layer is one of the smallest datasets the programme owns.
The real costs are four disciplines, none of them hardware. The intercept: the enforcement boundary sits in the action path, and its evaluation-plus-write adds latency to every consequential action — single-digit milliseconds against a local policy engine, but it must be engineered, and it concentrates availability risk that the fail-open-or-closed decision has to own. The retention pipeline: per-record retention classes across jurisdictions — banking records typically held for seven years, HIPAA documentation for six, insurance longer in many places — plus litigation hold that overrides all of it, is unglamorous data engineering that must actually run. The reconstruction path: an authenticated, presentable, exportable query workflow is a real product surface with a real owner, or it silently rots. And policy maintenance: the records are only as meaningful as the entitlements and policies they reference, which somebody has to keep true as the business changes.
The cost asymmetry that matters most is temporal. Built before deployment, the layer is weeks of work riding on infrastructure the programme needs anyway. Retrofitted after, it is a rebuild — because write-at-act-time requires the enforcement boundary, which requires the entitlement model, and an agent already in production acquired neither. And the retrofit has a floor no budget removes: every action taken before the layer existed has no record and never will. The historical gap is permanent. If a reviewer's question lands inside it, the answer is a reconstruction project conducted under a deadline, with counsel present. That, and not the storage bill, is the cost comparison that should decide the sequencing.
The vacuum: three markets, one record
The supervisory landscape shifted in April 2026, and the shift is widely misread as relief. Read correctly, it raises the value of the attestation record in all three of the markets this practice covers.
United States: the guidance deferred, the duties did not. The revised interagency model risk guidance of 17 April 2026 — Fed SR 26-2 and OCC Bulletin 2026-13 — superseded SR 11-7 and expressly placed generative and agentic AI outside its scope, with separate guidance promised. That is a deferral, not an exemption: the record-keeping expectations that ride on safety and soundness, consumer protection and fair lending attach to the action regardless of what performed it. What disappeared is the framework that would have specified the evidence format — which means the examiner still arrives, still asks the four questions, and no template exists that a firm can point to as sufficient. In that vacuum the firm's own attestation record is the whole answer, and the firms writing good ones now are, in effect, drafting the evidentiary baseline the separate guidance will later be written against. On the insurance side the NAIC's model bulletin on insurers' use of AI systems, adopted across a majority of states, already expects documented governance of AI-influenced decisions — and an adverse-action question about an agent-touched claim is answered by exactly these four records or by nothing.
India: the retention clock and the purpose test are already statutory. The DPDP Act binds processing of personal data to stated purpose, and the DPDP Rules put a live Data Protection Board behind it; the Reserve Bank's model risk management direction pulls regulated finance the same way, with retention horizons that align to banking record norms of seven to ten years. For an agent estate, purpose limitation is an input-record question — what entered the context, from where, under what classification — and a grievance escalated to the Board is answered on the Board's clock. An Indian deployment that cannot produce the input and authority records is not facing a documentation gap; it is facing an unauthorised-processing question with statutory teeth. Of the three markets, India is where the input record earns its keep soonest.
The Gulf: the record is what board accountability compiles down to. The Central Bank of the UAE's February 2026 guidance note expects licensed institutions to show a documented AI governance framework, a risk-rated inventory and board accountability for outcomes; SAMA's frameworks carry comparable expectations in the Kingdom. Board accountability for an autonomous system's outcomes is an abstraction until an incident makes it concrete, and what makes it concrete is precisely the reconstruction: what was done, on whose authority, under which policy, on which inputs. The Gulf's structural advantage is that so much of its agent estate is new-build inside sovereign-scale programmes — the attestation layer can be designed in rather than retrofitted, at schema-decision cost rather than archaeology cost. The corresponding weakness, visible today, is records designed for operations rather than for scrutiny; the four-record shape is the difference.
Attestation is what falls out of the stack — the dependency-order argument
The deepest mistake in this territory is sequencing, and it is common because it is well-intentioned: attestation is the layer auditors ask about, so programmes build it first. Comprehensive logging, every call captured, dashboards over all of it. Then the incident arrives and the log answers the wrong question. It shows the agent called an API at 14:07 and got a response. Whether the agent was entitled to that record — nobody wrote down what it was entitled to. Which policy evaluated the action — no policy was evaluated. The organisation holds a perfect record of an event it cannot characterise, and characterising it was the entire point. Much data, no evidence.
Look at where the four records' contents come from and the sequencing argument makes itself. The authority record is a reference into the entitlement store — it can only exist if entitlements exist as first-class objects with grantors and expiries. The input record is emitted by a governed context pipeline — it can only carry provenance if provenance survived retrieval. The policy record is the enforcement boundary's own evaluation output — it can only be written if an engine actually ran between intent and effect. Only the decision record is genuinely new plumbing, and it is the easy part: an action identifier and a state capture at a boundary you already control. Three of the four records are exhaust from layers an acting system needs for its own sake. Build those layers and attestation is mostly a write path; skip them and attestation is a warehouse of well-indexed unanswerable questions.
This is the same dependency-order argument I have made elsewhere about the four properties of a governed acting system, seen from the evidence end: entitlements, governed context, enforcement, attestation — in that order, because each layer supplies the one above it. The practical reading for a team mid-programme is unusually actionable: if you already have entitlements and an enforcement boundary, you are four fields and a store away from attestation, and you should take the four fields. If you have neither, the attestation budget is better spent one layer down, because the records you could write today would be transcripts with better formatting.
What this argument does not prove
Five limits, stated plainly, because a case this strong can afford them.
Attestation is not prevention. A flawless record of a harmful action is still a harmful action; this layer bounds diagnosis time and blast-radius uncertainty, which is what keeps programmes alive after incidents, but nothing here stops the incident. Anyone selling attestation as safety is selling the wrong property. Second, the schema above is a practice position, not a standard: there is no settled schema, no interchange format, and no consensus on what a supervisor should be shown; this corner of the field is genuinely immature, and I expect parts of my own sketch to be wrong in three years. Third, text-only harms leave thin records by construction — an agent that reads correctly, acts within scope, and summarises misleadingly produces four unremarkable records around a bad outcome; attestation evidences authority, not wisdom, and decision-quality review remains a separate discipline. Fourth, a record nobody queries is theatre: if the reconstruction path has no owner, no drills, and no reviewer who has ever actually used it, the layer exists on the architecture diagram and nowhere else — the test is a rehearsed reconstruction, run before a real one is demanded. Fifth, the tooling gap is real: the observability platforms trace superbly and attest barely; the bridge from traces to the four records is architecture work someone in your organisation has to own, and buying a tracing product does not discharge it.
The test to hold your own system against fits in one sentence: if this agent acted wrongly last Tuesday, what can you produce today — and how long would it take? If the honest answer is the transcript and a reconstruction project, the choice in front of you is not whether the four records get assembled. It is whether they are written quietly at the moment of action, or assembled expensively under a deadline, with the reviewer already in the room. If you are deciding what your attestation record should contain before someone else decides for you, that is precisely the kind of working session I do.