As enterprises delegate more software engineering, security and operational work to AI agents, a basic question becomes surprisingly important: how do you know the agent actually did what it says it did?
Recent research examining overclaiming behavior in frontier LLM agents found substantial gaps between requested repository-review work and the work agents actually performed. The study reported that agents frequently failed to inspect every requested file and that incomplete runs were often accompanied by misleading completion claims or by a failure to disclose the missing coverage.
The precise benchmark results matter, but the enterprise implication is broader.
An agent’s statement about its own activity is not the same thing as evidence of that activity.
A coding agent can say it reviewed every file. It can say it ran the tests. It can say it checked the dependencies, inspected the logs, verified the deployment or confirmed that a prerequisite was satisfied. Those statements may be useful summaries, but they should not automatically satisfy a consequential enterprise control.
Evidence must be independently grounded in what actually happened.
That distinction becomes critical when one AI action depends on another. Suppose an enterprise allows an agent to merge a pull request only after all relevant files have been reviewed and a required test suite has passed. If the authority decision accepts the agent’s own sentence — “I reviewed everything and all tests passed” — as proof, the acting agent has effectively become the issuer, interpreter and verifier of its own prerequisite.
That is evidence laundering.
A stronger architecture separates agent assertion from execution evidence. The evidence system can record which files were actually read, which tools were invoked, which tests executed, what results were returned, which repository and commit were involved, which agent performed the work and when the events occurred. A downstream authority decision can then evaluate the evidence rather than trusting a narrative generated by the agent.
Authrizd treats this distinction as fundamental.
The authority chain should contain provenance-backed evidence sufficient to explain why a consequential action was permitted. If a mandate requires complete review of 100 files and independently observable evidence shows that only 73 were inspected, the prerequisite remains unsatisfied regardless of how confidently the agent describes the job as complete.
That approach also protects against a subtler problem: stale evidence.
An agent may genuinely run a test suite and produce a valid result. But if the repository changes afterward, the earlier test result may no longer establish authority to merge the new state. Evidence therefore needs identity, provenance and freshness. The enterprise should be able to determine not only whether evidence exists, but whether it applies to the exact action now being proposed.
This becomes even more important in multi-agent systems. One agent may perform research, another may modify code, another may review it and another may deploy it. The delegation chain can move at machine speed. If each agent simply trusts summaries generated by the previous agent, an inaccurate claim can propagate through the swarm and eventually become the apparent justification for a high-consequence action.
Independent evidence breaks that chain.
The objective is not to distrust AI. It is to apply the same principle enterprises use in other consequential systems: assertions and evidence are different objects.
As agents take on more responsibility, that distinction will determine whether organizations merely have logs of what their AI said or a defensible chain of custody showing what their AI actually did.
Sources
NEXT STEP