The agent cannot keep its own record

No serious court lets a party to the dispute keep the official transcript. The reason is not that we assume litigants are liars. It is that the transcript is the thing the case will be argued from, and a document that one side can shape is a document the other side cannot trust — regardless of whether it was, in fact, shaped. The court reporter sits apart from both parties for a structural reason, not a moral one. The same instinct runs through every mature accountability arrangement we have built. Auditors do not report to the executives they audit. The referee is not on either team. The recorder is separated from the actor because a record produced by the interested party carries the interested party's stake inside it, and a record like that cannot settle anything.

This is one of the oldest principles we have for making a record mean something, and agentic AI is quietly walking straight past it. When an autonomous agent takes an action and then produces the account of that action — writes the log, holds the trace, formats the explanation of what it did and why — the actor and the record-keeper have become the same system. Everything we learned about why that is a problem still applies. The account inherits the actor's interests and the actor's errors. It can omit what would be inconvenient, flatter what went well, and — whether by design, by drift, or by a later step in the same run — revise what was there. The account is not independent of the thing it accounts for. It is a limb of it.

The instinct to trust a self-authored record usually rests on a hope about honesty: if the system is well-intentioned and well-built, its account of itself will be accurate. But honesty was never what made records trustworthy. Independence is. We do not accept the court reporter's transcript because the reporter is a better person than the litigants; we accept it because the reporter had no stake in the outcome and no ability to alter the record after the fact. Trust in a record is not trust in the character of its author. It is confidence that the interested party could not have shaped it.

The defendant keeping the transcript

Consider what actually happens when a system authors the record of its own conduct. It is not merely that the system might lie. The deeper problem is that even a perfectly honest self-account cannot function as evidence, because evidence is defined by a property the self-account structurally lacks: that the party with an interest in the conclusion could not have determined what the record says. A confession freely given is still tested against independent facts precisely because we know that an account produced by an interested party — even a sincere one — is not self-validating. The agent's log has exactly this defect. Its accuracy, if it is accurate, cannot be established from the log itself, because the log's author is the party the log exonerates or implicates.

The much-discussed problem of an agent's narrated reasoning is one instance of this, not the whole of it. Yes, a system's explanation of why it acted may not be what actually moved it. But even a faithful narration would not solve the underlying issue, because the narration is still held and formatted by the actor. The general principle is broader than any worry about candor: the record of an action must be produced and held by a mechanism the acting agent does not control. Whatever the agent can author, it can also shade; whatever it can hold, it can also lose; whatever it can revise, it can also rewrite. None of this requires bad faith. It requires only that the same system occupy both roles, which is the arrangement we have spent centuries designing our institutions to forbid.

A record the actor can edit is a confession it can retract; only a record it cannot touch can convict or clear it.

Tamper-evidence is not a feature, it is the point

It is tempting to treat tamper-evidence as a hardening measure — a nice property you add to a logging system once the logging works. That gets the priority exactly backward. Tamper-evidence is not an enhancement to the record; it is the condition under which there is a record at all, as opposed to a draft the actor happens to be keeping. The difference between a log an agent writes and a record it cannot touch is the difference between a diary and a deposition. A diary is written by its subject and answerable to no one; you may find it moving, but you would not convict on it. A deposition is captured by a process outside the subject's control and fixed against later revision. Only the second is evidence, and the thing that makes it evidence is precisely that its subject could not have arranged what it says.

So the requirement is not that the agent keep a good log. It is that the record be captured outside the actor's control and be unrevisable by it. Those are two distinct demands. Capture-outside-control addresses authorship: the account is written by a mechanism the agent does not own, so the agent cannot decide what is and is not in it. Unrevisability addresses persistence: once written, the account cannot be quietly amended when a later step, or a later run, or a later operator would prefer a different history. A system that can rewrite its own past can launder any action into compliance after the fact, and a record that can be laundered is not a record — it is the current preference of whoever holds the pen, dressed as history. Tamper-evidence is what lets a later reader tell the difference between an account that has been preserved and one that has been arranged.

Building the independent recorder

What does independence require in practice? Three things, and none of them is honesty. First, capture by a separate mechanism: the account of an action is produced by something structurally outside the agent that took it, so that authorship of the deed and authorship of its record do not sit in the same hands. Second, tamper-evidence: the record carries proof of its own integrity, so that any alteration after capture is visible as an alteration rather than passing as the original. Third, custody outside the agent: the record is held and can be produced by a party the acting system does not control, so that the ability to disclose it — or to make it disappear — does not belong to the party with the most interest in its contents. Provenance and chain of custody are not bureaucratic overhead here. They are the load-bearing structure. They are what let the record be handed to someone who wants to contest the action and have it survive their scrutiny.

This is the precondition, not a refinement of it. A record produced under these constraints can be evidence, because the interested party could not have shaped it. A record produced without them is testimony — the account of the most interested party in the room, offered about its own conduct, with no independent hold on whether it is true. A self-authored agent record is not worthless; testimony is not worthless. It can be a useful starting point, a lead, a thing to check. But it cannot be the evidence, and the category error of treating it as such is the quiet failure at the center of a great deal of agentic tooling being shipped today. A Decision Receipt earns its standing not by being a more articulate self-description but by being a record the acting system did not author, cannot hold, and cannot revise — captured independently, tamper-evident, and out of the actor's reach. Independence, not eloquence, is what makes it evidence rather than autobiography.

The frontier does not change the principle; it removes the human who used to satisfy it. When a person acted on a machine's advice, the person was a second party who could keep an account of what the machine had said. An agent that acts alone has no such witness — unless one is built, deliberately, and placed where the agent cannot reach it. That is not a constraint on autonomy. It is the thing that lets an autonomous action be answered for at all.

— Dispatches · Summit Cognitive