Topic starter
25/06/2026 12:37 am
TL;DR: AI agents are making millions of decisions across chained services, but without a cryptographically verifiable audit trail, organisations cannot reconstruct who did what, why, or when, according to Strata Identity. That turns observability into a governance, compliance, and litigation problem, not just an engineering one.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Blind spots: Your agents are operating in complete darkness (and so are you)”.
Key questions
Q: What breaks when organisations only log inputs and outputs for AI agent workflows?
A: Input and output logs hide the reasoning path that connects a user request to the final action.
Q: Why do agent observability gaps create legal and compliance risk?
A: Because regulators and litigators ask for proof, not summaries.
Q: How do security teams know if agent observability is actually working?
A: Observability is working only when teams can tie together token activity, tool calls, and latency for a specific agent session.
Practitioner guidance
- Capture end-to-end delegation lineage Record every hop from the initiating human request through each agent, service account, token exchange, and downstream API call so the full chain can be reconstructed.
- Add cryptographic integrity to audit trails Use signed, hash-linked records for agent actions so post-event review can detect tampering or substitution in the evidence trail.
- Define proof requirements for regulated workflows Classify which agent transactions must retain immutable evidence for finance, customer data, or other regulated processes before they go into production.
Bottom line: AI agent observability now has to satisfy audit, legal, and governance requirements, not just operational monitoring.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:32 am
Agent observability has moved from an engineering preference to an evidence-control requirement. The central issue is not whether teams can see alerts, but whether they can prove the exact delegation chain behind an action. When AI agents operate across services and identity layers, conventional logs do not establish accountable proof. The practitioner conclusion is simple: if the record cannot stand up in an audit or a deposition, it is not sufficient observability.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: What should organisations do when agent workflows cross several identity systems?
A: They should require a single evidentiary view that links the initiating identity, each delegated identity, and the final system action. Without that chain, each platform may look correct on its own while the overall transaction remains impossible to prove.
👉 Read our full editorial: Agent observability is now a governance and legal exposure