When an AI agent acts on someone's behalf, the framework guarantees three things, and it guarantees them by construction — meaning the system cannot produce an agent action that lacks them, the way it could if these were merely policies someone has to remember to apply. First: there is always a responsible human — the agent acts only under a grant from a named person, and the final binding act is always a human's. Second: it is auditable — every action records who did it and, for a delegated action, the exact grant that authorized it. Third: it is discoverable and tamper-evident — that record is written non-suppressibly to FORAY, so the chain from an action back to the responsible person can always be walked and cannot be quietly altered. This note locks that as a commitment the agent work must preserve. The one piece it does not yet cover — watching an agent's conduct in real time and intervening before it misbehaves — is named as future work, distinct from the accountability this note guarantees.
Every agent action carries a responsible human, and that responsibility is auditable (the action records who acted and what authorized it) and discoverable (the record is tamper-evident and the chain back to the responsible person is always walkable). This holds by construction — the system cannot produce an agent action without it — not by policy that could lapse.
Two structural facts make the responsible human a precondition for an agent action existing, not metadata that could be omitted:
commit_assertion rejects an agent actor) and again at the HTTP boundary — two layers of defence. The agent can act and propose; it can never commit.Because both are enforced in code, the responsible human is not a field that could be left blank — it is a condition for the action to occur at all. This is responsibility by construction, distinct from responsibility by policy (which can be skipped, forgotten, or disabled).
Two layers, both structural:
kind (person / companion / agent / contributor), id, and — for a delegated action — a capability reference, the id of the delegation assertion that authorized it. So an agent action does not merely say "an agent did this"; it carries a walkable link to the specific grant that permitted it, which traces to the person who granted it. The AI origin is marked and cannot be suppressed.The full chain is always present and always walkable:
this action ← performed by this agent ← under this delegation ← granted by this person ← who committed it ← recorded tamper-evidently.
Every link lives in the data, not in a policy that might lapse.
No single product owns the agent end-to-end; that separation is deliberate.
Covered (and guaranteed by construction): after-the-fact accountability and discovery — who is responsible, what authorized the action, what was done, all attributed and tamper-evident, the chain always walkable.
Not covered (named as future work): real-time behavioral governance — watching an agent's conduct as it acts and intervening before it does something unwanted (monitoring, anomaly detection, pulling an agent's authorization mid-flight). This is Loomworks/delegation territory and is the same ground the agent-governance competitors occupy (Oasis, Astrix, Entro — governance overlays). The structural safety (the agent cannot commit) and the accountability (everything is attributed and discoverable) are built; live-conduct governance is not yet designed.
The distinction matters and should not be blurred: this note guarantees you can always discover, after the fact, who is responsible and what happened. It does not yet guarantee you can catch an agent misbehaving in the moment. Both matter; they are different pieces, and only the first is settled here.
Any future agent work — Stele's agent-authentication path, the delegation substrate, Companion Agents, an eventual behavioral-governance layer — must preserve the §1 commitment. Specifically:
A future behavioral-governance layer adds to this; it must not be built in a way that bypasses or dilutes the structural accountability above.
Settled: agent actions carry a responsible human, auditable and discoverable by construction (§1–§3); the four-product ownership split for agent responsibility (§4); the boundary between guaranteed after-the-fact accountability and undesigned real-time governance (§5); the invariants the agent work must preserve (§6).
Open (named, not designed here): the real-time behavioral-governance layer (monitoring an agent's conduct and intervening mid-flight) — Loomworks/delegation territory, future scoping. It must add to, never bypass, the structural accountability this note locks.