The record shows the policy held, the timestamp marked the run complete. The only witness to the crash is sitting in the driver's seat.
When an autonomous system causes an incident, the primary source of forensic truth is the telemetry the system produced about itself.
Security incident response was built on the discipline of digital forensics: an external observer collects disk images and network logs to reconstruct what occurred. The investigator assumes the adversary or malfunctioning process sought to evade detection, while the logging infrastructure faithfully recorded the external traces of the activity.
Autonomous agents upend this evidentiary separation. The agent is both the actor executing instructions and the scribe documenting its own conduct. The structured JSON records showing that parameters were validated and permissions were verified come directly from the runtime environment of the machine under investigation. When the accused writes the log, compliance evidence auto-generates regardless of outcome.
What survives and what vanishes
The apparent completeness of an execution log is deceptive.
A standard agent audit trail records external actions: API requests sent, database records updated, or status codes received. These outward milestones look thorough in a dashboard, bearing precise millisecond timestamps and valid schema structures. They satisfy compliance auditors because they match the shape of traditional application telemetry.
What drops out of the record is the internal reasoning trace that produced those actions. Due to storage costs and privacy defaults, raw prompt contexts and intermediate tool evaluations are routinely discarded. The investigator receives the final decision, shorn of the associative leaps or hallucinations that prompted it.
This replicates the condition documented in Epistemic Dark Matter. What the log fails to preserve ceases to exist for the purposes of institutional review. Reconstructing why an agent transferred funds to an unverified vendor or dropped a firewall rule becomes impossible when the operational history contains only the terminal command and a machine-generated assertion that policy checks passed.
The eight-point-five percent reality
In an enterprise automation survey covered by Redmond Magazine in August 2026, only 8.5 percent of respondents preferred fully autonomous incident closure. The overwhelming remainder wanted a human review gate before an operational ticket was marked resolved.
The finding reflects a well-founded skepticism. Yet the operational volume curve pushes relentlessly against human review. When autonomous agents generate thousands of actions daily, human reviewers face an impossible triage load. They skim the auto-generated summary, see that the agent logged compliance at every step, and approve the closure.
This is attestation rot. The phrase the system logged approval comes to substitute for actual human comprehension. What the Descendant Inherits showed how polished, well-formatted artifacts survive bureaucratic scrutiny while messier, truthful records get purged. In agentic operations, a well-formed log with clean status codes passes audit inspection even when the underlying decision was nonsensical.
Custody of evidence for machine actors
The solution to this evidentiary dilemma is architectural separation.
If an actor is autonomous, it cannot be the sole custodian of its own record. Legitimate forensic assurance requires two fundamental design invariants:
- Independent event sinks: telemetry must stream synchronously to write-once, append-only stores outside the agent's execution environment, preventing post-hoc log alteration.
- Contextual replayability: prompt states, tool parameters, and raw model completions must be captured alongside terminal actions, allowing deterministic replay of the failure mode.
Without this separation, post-incident reviews remain an exercise in administrative theater. An organization presents a flawless audit log proving that every safety guideline was checked, while standing amid the debris of an action nobody intended.
Companions
- The disappearance of unindexed history: Epistemic Dark Matter.
- The institutional survival of polished records: What the Descendant Inherits.
- Enterprise survey on autonomous incident closure: Redmond Magazine.
- The verification audit against source records: Sixteen Days.
- The operational requirement: the Interim Protocol, whose second rule requires custody of the path from source record to accepted conclusion, at a grain where someone who was not there can reconstruct it.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.