When an Agent Takes the Action, Its Own Logs Are Not the Proof
The audit question moved
A chat agent that only produces text has weak felt pain. Pain concentrates where an agent takes an action with a consequence someone can later be asked to defend: moving money, approving or denying a claim, posting an entry to the general ledger, filtering a job candidate, closing a security incident, filing a document to a regulator. Once an agent runs long and stateful across a session, the question stops being "what did the model output" and becomes "what did this agent actually do, and on what basis." That is an audit question, and it has an owner the moment an obligation exists.
Telemetry is the system's word about itself
The common answer is observability. Log every step, trace every call, add a guardrail that watches behavior. That tells you what the system says it did. It does not let anyone else check. An executor that also vouches for its own output is grading its own exam, no matter how complete the logs are. A regulator, an auditor, an insurer, or a court is not asking the system to describe itself. They are asking for evidence that survives without trusting the party that produced it.
An independent receipt is something a third party can check
The fix is not a stricter log. It is separating who runs the inference from who proves it ran correctly. A cryptographic receipt binds the model, the input, and the output so a third party can verify the result without trusting the vendor and without re-running the job. Cryptographic receipts with probabilistic replay are live today for embedding workloads and for any ONNX-exportable model through bring-your-own-ONNX upload. For generative and agentic decision flows the honest position is design-partner stage, not a production claim. The direction is the same in both cases: the human sign-off stops being the last line of defense and becomes one more thing that can be checked, rather than simply believed.
Where the felt pain concentrates
The target is an intersection, not a single trait. The company runs AI in production where an agent takes or directly recommends a consequential action, and it owes a correctness obligation to a regulator, auditor, enterprise customer, insurer, or court. Outsourced compute alone is not felt pain. The intersection is. The obligations are arriving on a fixed clock: EU AI Act general applicability on August 2, 2026, OSFI Guideline E-23 for Canadian federally regulated institutions in May 2027, SOX controls over any AI-touched reporting chain, DORA for financial-entity ICT. Each one creates a dated, unowned question: who can prove what the agent did. The cheapest moment to answer it is while the agent's action scope is being designed, not after an examiner asks.