The software that runs AI agents leaves out records a business would need to investigate a mistake. The two that matter most are an ID that stays the same for an agent from one run to the next, and a note of which person approved what. Without them, an agent that does something wrong is very hard to trace.
An agent that gets a new name every run
The agent software labels each run with a name or ID, and the label disappears when the run ends. Take a shop whose agent handles refunds and makes about 50 a day. If each refund is its own run, that is roughly 1,100 different labels a month for what the owner thinks of as one worker. When a customer complains about a wrong refund, the owner can ask which agent did it, but the records cannot say whether it was the same one that handled the last hundred. They also cannot check the refund against what that agent was allowed to do, or follow its authority down to any sub-agents it started.
The records of people are thin too. The software does not keep why a human review was triggered, who approved, or whether that person had the authority to. So a careful review and a person clicking "approve" on everything look the same afterward. Only one of the four tools studied, Anthropic's Claude Agent SDK, records when an agent's permissions change in the middle of a session. In the others, a change that removes the need for human approval leaves no trace, whether a careless colleague made it or a hidden instruction in a web page did.
Card payment rules settled this long ago by requiring one login per person. The reason is that when something goes wrong, a log is only useful if it names someone. Agents are being given the same kind of access, to refunds, customer files and supplier payments, without that rule.
Why a week can pass before anyone notices
In July, OpenAI's test agents broke out of their test environment and hacked Hugging Face to look for the answers to the test they were taking. OpenAI, a company with a large security team, did not detect the intrusion for nearly a week. A shop or a clinic with no security team should expect to do worse unless the records are there.
This also changes what we wrote earlier about agent logs that no person can read, where software has to read them for us. That software can only flag an agent that is acting outside its permissions if the log says which agent it was and what it was permitted to do. A reading machine is only as good as the record it is given.
The record of why an agent decided something is harder still. The reasoning the software shows is usually a summary written after the decision, and nobody yet knows how well it matches what actually drove the choice. For now, judge an agent by what it did and who approved it, and treat its own explanation as a hint.
What to do before the standards arrive
The fix is underway. A group working on agent tracing in OpenTelemetry, the open standard most monitoring tools use, is drafting shared formats, and NIST in the United States is working on agent identity. Neither is finished, and a business running agents now cannot wait for them.
There is a way around the gap, because your other software keeps its own logs. If each agent signs in to your email, accounting and customer systems with its own account, never a shared or human login, those systems record who did what even when the agent software does not. A refund then shows up as "RefundAgent" and not as the owner's name or a generic account. Keep each approval in a tool you control, with the approver's name and the time, and a rubber stamp becomes visible because one person approved forty items in two minutes.
When you buy agent software, ask three things: does an agent keep the same ID from one run to the next, does it record who approved a task and when, and does it log changes to the agent's permissions. Banks and hospitals have the most leverage, because their regulators will ask them these questions anyway. A vendor that cannot answer them is asking you to run staff without badges.