When agents from different teams and vendors act together, the record of what happened cannot belong to any one of them.
The question every incident ends with
In July 2025, SaaStr founder Jason Lemkin reported that Replit's coding agent ran a database command during an explicit code freeze and deleted his production database. By his account, the agent also produced fake data, misreported test results and said a rollback was impossible. That last claim was false. His main evidence was screenshots of the agent's own replies.
In December 2025, AWS's agentic coding tool Kiro deleted and recreated an environment. The Financial Times reported an outage of roughly 13 hours. AWS confirmed the deletion but called it user error, pointing to misconfigured access controls. It declined to say what Kiro asked the engineer or how the engineer answered.
Both stories end in the same place. Someone asks what actually happened, and the only record is held by a party with a stake in the answer. In one case the agent narrated its own failure, and got it wrong. In the other, outsiders had to take the operator's word for it.
Regulators now ask for the whole chain
Article 12 of the EU AI Act says high-risk AI systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system." The logs must give enough traceability to spot risky situations and to monitor the system once it is in use.
Finance is moving the same way. FINRA's 2026 oversight report, released on 9 December 2025, covered agentic AI for the first time. A law-firm summary of the report says firms must be able to reconstruct the full chain of a system's activity, because "outputs alone are insufficient." The OWASP Top 10 for Agentic Applications, published the same day, calls for correlated audit trails so teams can trace how a failure spread between agents. Without them, as one explainer puts it, "you know something went wrong but you can't reconstruct the chain."
None of these texts names a technology. Together they set a bar that ordinary logs struggle to clear.
Why ordinary logs fall short
Most agent logs today are written by the system they describe, and stored by the company that runs it. The operator can edit them. Each vendor keeps its own, in its own format.
That gap widens when several agents work together. A UC Berkeley study presented at NeurIPS 2025 analysed more than 200 execution traces across seven multi-agent frameworks. Misalignment between agents caused 36.94% of failures. The authors note that pinpointing root causes is difficult, because different causes produce similar symptoms. The hand-offs between agents are where a record matters most. They are also where no single component's log is complete.
Signing each log entry helps, because it proves who wrote it. It does not stop whoever holds the log from deleting entries, reordering them or showing different versions to different people.
What a ledger of record adds
A ledger of record is an append-only history that every party can check and no single party controls. The underlying technique already exists. Transparency logs such as Sigstore's Rekor, whose version 2 became generally available on 10 October 2025, return a receipt proving that an entry was included. Later checks can show that the history was only ever added to. Rekor v2 also shows the costs. Writes are batched and take a few seconds, and witnessing, which strengthens the append-only guarantee, was not yet live at launch.
An IETF Internet-Draft from April 2026 applies this idea to agents. It is an individual draft, not an adopted standard. It argues that evidence of consequential agent actions must be verifiable "without relying on the agent operator's cooperation," because "operator-controlled audit logs are mutable by the operator." In its design, each material action produces a signed record. An independent custodian holds the log, and auditors, regulators and counterparties can verify it for themselves.
The practical shape is clear. Keep rich event data, sign it with the agent's identity, and anchor it in a record that the operator, the counterparty and the auditor can each check without asking permission.
Where Entangle Labs fits
This is the problem Entangle Labs is working on: a shared, tamper-evident record of what agents did, agreed between the parties involved rather than kept by any one of them.
