An agent reports that no data left the system. Its explanation appears coherent. Yet a tool may have transmitted an inventory to an external service. If the organisation retains only that agent’s summary, how can it distinguish no transmission from a transmission omitted from the report?
In my maturity framework, level 6 addresses observability and control of actions. This personal framework is not a certification standard. With Swarm, I work on linking requests, decisions and effects without treating an agent’s narrative as their independent evidence.
An export missing from the report
Consider an inventory analysis task. The agent has a reading tool and a tool able to transmit results. It prepares an export to an external destination, then summarises the session as “analysis complete, no transmission”. A summarisation error could be enough; this scenario does not assume an established intention to conceal.
The inventory could disclose versions, roles or relationships between assets. If transmission occurred, correcting the report does not retrieve the data received by the destination. If its outcome remains unknown, describing it as absent could delay investigation and protective measures.
A report is a statement to compare with events. Its confidence does not replace observation of the effect.
The agent’s proposal, the applicable approval, the call actually committed and the result supplied by the relevant component are distinct. A call record alone does not establish what the recipient received. Nor does a missing event establish that no action occurred when collection is incomplete.
Separate collection from narration
An assessable architecture collects events at the relevant boundaries: request preparation, authority checks, tool invocation and result observation. Common identifiers help reconstruct the same operation across delegation and recovery. Distributed tracing, as described by OpenTelemetry, organises correlated operations; correlation certifies neither their truth nor their completeness.
Independence depends on effective permissions. A log on another machine remains alterable if the agent can access and erase it. The design must examine who produces, transmits, reads, retains and can modify the records. NIST SP 800-92 addresses the organisation of log management infrastructures and processes.
Collection may lose events, arrive late or miss an uninstrumented tool. Those limits must remain visible. Populating a dashboard does not establish coverage of every action path.
Observation does not itself prevent an effect
Detecting the export after transmission can support an investigation. It is not a prior destination check. Prevention requires an authorisation actually enforced before the effect, on the path used and against current parameters. An alert, a suspension decision and an effective suspension are different stages.
The supervisory mechanism also needs observation: collection failures, delays, unavailability and access to records. AI-assisted analysis can help correlate facts and formulate hypotheses; it must remain linked to accessible sources rather than becoming automatic proof.
What can be examined in Swarm
Swarm’s Rust code contains a read-only transaction audit for the Trust pilot. It verifies the recorded chain and correlates the mandate, request, exact approval, action state and connector receipt. It exposes missing links and distinguishes transaction verification from completeness.
These operations concern simulated effects. A valid local chain establishes neither collection completeness, the freshness of an external checkpoint, nor physical storage immutability. Ordinary activity logs are not a substitute for that chain. The Swarm code makes these contracts examinable; it does not establish a universal collector covering every operating-system or network action.
Preserve evidence without creating another disclosure
Records can themselves contain secrets or sensitive information. The OWASP Logging Cheat Sheet recommends limiting recorded data, protecting access and detecting alteration. Visibility should match the investigative need, with an explicit retention policy and assigned responsibilities.
Control over hosting, keys and permissions contributes to this autonomy. Local deployment or a chosen provider does not, on its own, make a log tamper-proof. The operational objective is to explain what was observed, what is missing and which decisions the evidence actually supports.
Further reading: LLM anatomy: foundations; model weights, attention and cybersecurity.