The tools an agent was given

When we ask why an agent did what it did, we reach almost by reflex for its reasoning — the chain of thought, the stated justification, the little narrative the system offers about its own conduct. It reads well and it feels like the answer. But the reasoning is the last thing that happened, not the first, and it was not composed in a vacuum. Before the agent reasoned, it was handed a set of tools it could call and a body of context it was told to trust. Those two things did most of the work. The account we keep tends to record the part that talks and omit the parts that decided.

An agent is not a mind alone in a room. It is a mind wired to instruments and fed evidence — and both the instruments and the evidence came from somewhere, at some version, returning something in particular at the moment they were used. A decision made through tools and on context inherits the provenance of those tools and that context. If we do not record where they came from, we have not recorded the decision. We have recorded a monologue about it.

This matters more, not less, as agents act on their own authority. When a human decides on a machine's advice, the human at least remembers what they were looking at. When an agent acts, there is no one to remember. The tools it called and the context in scope at that instant are not recoverable by asking anyone afterward. They exist in the record or they do not exist at all.

The action is downstream of the toolset

Start with the tools, because they are the part most obviously left out. Whatever an agent does in the world, it does through some capability it was granted — a function it can call, a service it can query, a system it can write to. The set of tools is not scenery around the decision; it is a boundary on what the decision could even be. An agent with a stale pricing lookup and an agent with a live one will, faced with the identical goal and identical reasoning, take different actions — because the action is a function of what the tool returned, and the tools returned different things. Capability is context. What the agent could do, and what its tools actually handed back when called, is load-bearing in a way the reasoning trace rarely admits.

And tools are not fixed objects. They have versions. They have behavior that changes underneath a stable name — a search endpoint retuned, a database migrated, a downstream service that began returning a subtly different shape last Tuesday. The agent's reasoning can be word-for-word identical across two runs and the outcome opposite, because between the runs a tool it trusted started answering differently. If the record names the tool but not its version, and describes the call but not the return, it has preserved the label and thrown away the content. You can read such a record forever and never find the thing that moved the decision, because the thing that moved the decision was a value that came back over a wire and was never written down.

An agent is only as accountable as the provenance of the tools it was trusted to use and the context it was given to trust.

Context is evidence

The other half is context — everything placed in front of the agent before it acted. The documents retrieved to inform the task. The system instructions that framed its role. The memory carried in from earlier work and treated as settled. This is not background. It is the evidence the action rested on, in the strict sense: the material the agent took to be true and reasoned from. And like any evidence, it has a source, a time, and a chain of custody — or it has none, in which case it cannot be examined at all.

Treat context as evidence and a familiar discipline snaps into focus. Evidence you cannot inspect is evidence you cannot contest. If a retrieved document shaped the action, the party affected by that action has a plain interest in seeing the document — in the version that was actually in the window, not a paraphrase and not whatever the same query returns today. Without that, a whole class of failure becomes untraceable. A poisoned context — a planted instruction inside a retrieved page, an injected line in a source the agent was told to trust, a memory quietly corrupted upstream — can fully determine what the agent does while leaving its visible reasoning looking careful and clean. The reasoning is impeccable precisely because it faithfully followed evidence that should never have been there. If the context was not captured as it stood at the moment of action, no one can ever point to the seam where the wrongness entered. The agent will look like it decided badly, when in truth it was fed a lie and reasoned about it well.

This is the uncomfortable inversion of the frontier. We worry that agents will reason poorly. The subtler danger is that they will reason well over compromised inputs — and that a record centered on reasoning will exonerate the reasoning and never reach the input. Context poisoning is not a failure of thought. It is a failure of provenance, and only a record of provenance can catch it.

Provenance of the instruments

The remedy is not to make agents explain themselves better. Explanations are the system's account of itself, and the whole point of the frontier is that self-account is not enough. The remedy is to record the instruments and the evidence as they stood at the moment of action: which tools were in scope and at what version, what each returned when called, which documents and instructions and memory were in the context window when the agent committed to the act. Not a reconstruction of the agent's mood — a capture of what actually shaped the act.

Do that, and the action becomes replayable against the conditions that produced it rather than against a story told afterward. You can ask the concrete question: given these tools, returning these values, over this context, does the action follow? If it does, the record has earned its standing, and the responsibility sits where it belongs — on the goal, the grant, the design. If it does not, the divergence is the finding: a tool that had drifted, a return that had gone stale, a document that should not have been in scope. Either way the question is answerable, because the thing that determined the answer was written down. This is the same move the rest of these essays have argued for consequential decisions, carried to the place where the deciding is done through instruments the decider did not build and evidence the decider did not vet. The provenance of the tools is part of the provenance of the act. To omit it is not to keep a shorter record. It is to keep a record of the wrong thing.

So when an autonomous agent takes an action that matters, the account cannot stop at what the agent said to itself on the way. It has to reach the tools it was given and the context it was fed — because those were the agent's evidence and its instruments, and an action is answerable only to the extent that both can be laid on the table and examined. Everything else is a monologue with good production values, describing a decision it was never in a position to explain.

— Dispatches · Summit Cognitive