Agent Audit Trail Failure Modes: What Breaks and How to Contain It

The direct answer

Trace the failure case “identifiers regenerated between tools” through the workflow, then require a recovery check that can re-establish support for “every assigned instruction has a handling identity”.

For per-session traceability from instruction to human decision, the relevant audience is teams that cannot reliably connect agent assignments, produced artifacts, QA verdicts, and issue-resolution decisions. The decision should cover stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage. The supplied boundary starts with the current agent setup and representative session logs and ends with a per-session run directory and traceability coverage check, presented in reviewable form.

Trace completeness supports review; it does not prove correctness, approval, compliance, or the truth of an artifact's claims.

Map each failure to a signal and containment action

Only the QA reviewer may record pass, hold, fail, repair, or stop against the registered acceptance statements.

Inspect the interfaces in the workflow

The operating path includes stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage.

Use “identifiers regenerated between tools” as an entry-point fixture and “artifacts stored without the instruction that produced them” as a downstream fixture.

Treat retry as a separate consequential action

For a path affected by “QA verdicts recorded without proving output”, preserve an idempotency key, remote readback, or human decision before another attempt.

Preserve evidence before repair

• Freeze the triggering input and provenance for “human decisions captured without rationale”.
• Capture the last valid and first divergent state in stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage.
• Record the dependency, configuration, model, prompt, and policy versions that matter to per-session traceability from instruction to human decision.
• Assign hypothesis testing for “human decisions captured without rationale” to the tool operator without granting new authority.
• Require the QA reviewer to accept, reject, or escalate the recovery result.

Repair should not erase the evidence needed to explain “human decisions captured without rationale”.

Verify recovery against acceptance statements

Recovery is incomplete until the team reruns the original failure and checks whether “every assigned instruction has a handling identity” holds. Add a regression case that also tests “QA verdicts include evidence” under the repaired condition.

If the failure case “sensitive values copied into the audit record” remains possible, keep the affected path at hold.

An error message is not containment for “identifiers regenerated between tools”; recovery must also re-establish support for “every assigned instruction has a handling identity”.

Know when the failure model has expired

Revisit the failure model for per-session traceability from instruction to human decision after any of three changes: the input boundary no longer matches the current agent setup and representative session logs; the operating path no longer matches stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage; or the expected output no longer matches a per-session run directory and traceability coverage check.

Also reopen the model when permissions, dependencies, or operators introduce a path for per-session traceability from instruction to human decision that the original fixtures never exercised.

How the sources bound the failure modes decision

For per-session traceability from instruction to human decision, the live catalog limits the offer to two elements. The supplied boundary is the current agent setup and representative session logs. The catalog names the deliverable as a per-session run directory and traceability coverage check. It cannot establish whether “every assigned instruction has a handling identity” holds in the buyer's environment.

Connect those narrow roles to a local fixture for “artifacts stored without the instruction that produced them” rather than treating citation status as a pass.

For per-session traceability from instruction to human decision, limit the conclusion to the documented workflow and let the agent supervisor retain the current source-to-claim map. New authority or data requires the session owner to review the evidence boundary again.

Product-specific failure modes review drills

These drills connect per-session traceability from instruction to human decision to concrete inputs, failures, acceptance statements, and owners. For per-session traceability from instruction to human decision, the drills connect detection, containment, recovery, and regression.

The session owner models failures for per-session traceability from instruction to human decision with synthetic, non-secret stand-ins for the current agent setup and representative session logs. State-changing actions and every external effect remain inside the isolated fixture throughout and after each drill.

Trigger capture

At the boundary covered by the trigger capture review, introduce an authorized fixture showing “human decisions captured without rationale”. The session owner separates observable behavior from assumptions about the remaining workflow.

Document which element of the boundary covering the current agent setup and representative session logs is relevant to “QA verdicts include evidence”, then ask the agent supervisor to label the observation as supporting, contradictory, or incomplete without recording the acceptance verdict.

The QA reviewer makes the disposition answer whether “QA verdicts include evidence” holds. A missing answer makes the QA reviewer keep a per-session run directory and traceability coverage check outside the accepted state. The trigger capture review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

Reopen the case if the operating response to “human decisions captured without rationale” changes, even when the title and stated requirement remain the same.

First divergence

Test the boundary of the first divergence review with an authorized fixture showing “sensitive values copied into the audit record”. The agent supervisor marks where evidence ends and escalation begins.

Pair a scope record covering the current agent setup and representative session logs with a direct observation of whether “secrets and unnecessary personal data are excluded” holds. The tool operator retains the source and result together.

The QA reviewer links the finding “secrets and unnecessary personal data are excluded” to go, revise, or stop in the decision record. It does not treat completion of a per-session run directory and traceability coverage check as proof of every outcome. The first divergence review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

A new owner, fixture, or consequence for “sensitive values copied into the audit record” sends the first divergence review back to the agent supervisor for review.

Containment state

Use “identifiers regenerated between tools” as the bounded stress case for the containment state review. The tool operator records where the workflow boundary for stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage leaves its expected path.

Give the human decision owner an authorized, read-only boundary record covering the current agent setup and representative session logs plus the criterion “artifacts and tool receipts are addressable”. Their receipt identifies any missing proof.

The disposition belongs to the QA reviewer: accept the evidence for “artifacts and tool receipts are addressable”, request a repair, or preserve the current state. The containment state review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

Do not carry this verdict into a changed workflow, input class, or response to “identifiers regenerated between tools”; create a new bounded record.

Retry decision

Make “artifacts stored without the instruction that produced them” the negative case for the retry decision review. The human decision owner follows the case through stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage until the first unsupported transition.

For the retry decision review, the human decision owner reviews a scope record covering the current agent setup and representative session logs against the requirement that “open issues resolve to a named decision” holds. Unrelated artifacts are excluded.

The QA reviewer treats completion as insufficient unless the record resolves “open issues resolve to a named decision”. Merely producing a per-session run directory and traceability coverage check does not settle the drill. The retry decision review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

Schedule another retry decision review if “artifacts stored without the instruction that produced them” acquires a new consequence or reaches a different owner.

Recovery proof

Build the recovery proof review around a case involving “QA verdicts recorded without proving output”. The human decision owner checks which observed state in stable session identity, instruction assignment, agent identity, tool and artifact references, QA verdicts, exceptions, human decisions, and closeout coverage can support the next step.

Ask the session owner to reproduce evidence for “every assigned instruction has a handling identity” within the documented boundary covering the current agent setup and representative session logs. An unrepeatable result remains an open condition.

The QA reviewer closes the recovery proof review only when the record resolves “every assigned instruction has a handling identity”; otherwise the listed deliverable remains provisional. The recovery proof review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

The QA reviewer reopens the drill if the criterion “every assigned instruction has a handling identity” is judged with a different fixture, policy, or operating state.

Regression fixture

Reproduce a safe case involving “human decisions captured without rationale” as the entry condition for the regression fixture review. The session owner preserves the last state that the workflow can prove.

Run the case within the documented boundary covering the current agent setup and representative session logs while the agent supervisor checks whether “QA verdicts include evidence” holds. The observation must come from outside the candidate's self-report.

The QA reviewer resolves the regression fixture review by comparing the observed result with “QA verdicts include evidence”. Missing proof makes the QA reviewer block acceptance of a per-session run directory and traceability coverage check. The regression fixture review records pass after support, fail after contradiction, and hold while evidence remains unresolved.

Repeat the regression fixture review when the failure case “human decisions captured without rationale” appears with new data, permission, or consequences that the session owner did not review.

Frequently asked question

What are the main failure modes for Agent Audit Trail?

Begin with the failure cases “identifiers regenerated between tools” and “artifacts stored without the instruction that produced them”. Give each condition a detection signal, containment owner, recovery check, and a regression test that checks whether every assigned instruction has a handling identity.

A product bridge, with a boundary

The Agent Audit Trail is the relevant sincLLM offer for this narrow problem. The frozen live catalog describes its required boundary as the current agent setup and representative session logs and its deliverable as a per-session run directory and traceability coverage check. The offer description is a scope boundary, not proof of technical sufficiency, compliance, safety, commercial value, or fit for this buyer.