1. Analysis
2. The exploration
3. Why logs
4. What is required
5. By jurisdiction
6. Locating the actor
7. For framework builders

What a checkable record would have to hold

Three standards efforts are converging on a record shape for what software agents do. This document asks a narrower question of them than they ask of themselves: for each of the eight things the law can require a record to hold, does the shape have a field for it?

The answer is mostly yes, with two gaps, and the gaps are not where a reader would guess. Integrity is well served. Who was affected and which law applied is served by almost nothing.

The shapes

Two are IETF drafts: one for an agent audit trail, one for an agent action capsule registered against a transparency service. Two are standards in preparation, one from the international standards bodies and one European, which both of the drafts name as their alignment target. The fifth is a constraint-record proposal built on the capsule draft.

Two of the five could not be read at the field level, and that is a finding rather than a limitation of this reading. The international and European standards are exactly the two that the drafts point to for everything else, and both are paywalled and still moving. A convergence whose two most-cited references cannot be checked against each other is a weaker convergence than the citation count suggests. Where a cell below says the source was not read, it means the text was not reachable at that depth, which is a different thing from a shape that carries nothing.

The two gaps, in order

Which person and which place is the worst-served category. Two of the five shapes carry no field at all, one carries a single value in the wrong shape, and the two shapes with the most authority to fix it are the two that could not be read. This is the category the law leans on hardest, and it is the one the emerging record shapes answer least.

Retention and access is the second, and it splits the shapes cleanly. One draft has a clean stated answer in months. The capsule draft and the proposal built on it carry nothing. The European standard's one legible fragment ties retention to the point at which a harm can be attributed rather than to a fixed period, which is a different rule, and whether the two compose or compete is not answered by anything read here.

What was shown to the person has no field in any shape. The basis for a decision is comparatively well covered. What the person was told before they answered a consent or age question is not, and that is missing exactly where it matters most: an action driven by a check whose validity depends on what the person was shown.

Lineage is absent on purpose, across every shape that touches inputs. Both drafts digest inputs and outputs instead of storing them, by explicit privacy-by-design rule, because a record that cannot be retracted once committed is the wrong place for content. That is a real trade against the law's demand that an auditor be able to trace a decision back to the data that fed it. Satisfying both needs a separate, access-controlled evidence store that the digest points into, and none of the five shapes specifies one.

Which component records, and who reads it

The shape of the record follows from where it is written. An agent that records itself has no independent witness; a gateway that records on behalf of the agents passing through it signs with its own key, and that independence is the one part of the arrangement a standard actually backs.

A gateway that records for the agents passing through

Each line names the shape and clause the field comes from. A line marked as having no standard field has no home in any of the five shapes, and is an operator convention rather than something a verifier can be expected to understand.

# one row per agent action seen at the enforcement point
event_record:
  emitted: always            # AAC 5.5.3, every verdict
system_and_actor_identity:
  actor_identity: developer  # AAC 5.1, agent and version
  system_identity: operator  # AAC 5.1, accountable tenant
  recorder_identity: recording_component  # AAT 3.2
human_involvement:
  human_disposed: boolean    # AAC 5.5
  approver: human|policy|counterparty     # AAC 5.5
inputs_and_outputs:
  request_digest: sha256     # AAC 5.3, once dispatched
  response_digest: sha256    # AAC 5.3, once confirmed
  # source of the input: no standard field
decision_basis:
  constraint_records: []     # AAC 8.1
  verdict_class: string      # AAC 5.5.1 registry
  # disclosure_shown: no standard field
person_and_jurisdiction:
  jurisdiction_check: constraint_record   # not standard
  # predicate result plus evidence digest, never a location
integrity_and_recorder:
  capsule_id: sha256         # AAC 5.1, content-addressed
  producer_envelope: cose_sign1  # AAC 3.1, own key
  attestation_mode: self_attested|anchored   # AAC 5.4
retention_and_access:
  retention_period: null     # no standard field
  access_class: null         # no standard field

An agent that records itself

With no independent witness, the one field that lets a verifier see from the record alone that nobody but the agent vouches for it is the declared trust level. A record without it is a record whose weight cannot be judged.

# one row per action the agent takes and logs itself
event_record:
  emitted: always            # AAT 8.2, no gaps in the chain
system_and_actor_identity:
  agent_id: urn              # AAT 3.1, a persistent URI
  agent_version: semver      # AAT 3.1
  recording_component: absent  # AAT 5.1, self-recording
human_involvement:
  human_override: object|absent  # AAT 3.2
inputs_and_outputs:
  input_hash: sha256         # AAT 3.2
  output_hash: sha256        # AAT 3.2
  content_fingerprint: sha256  # AAT 3.2, erasure proof
decision_basis:
  reasoning_hash: sha256     # AAT 7.3
  policy_ref: string         # AAT 7.3
  deny_reasons: []           # AAT 3.2, when denied
  # disclosure_shown: no standard field
person_and_jurisdiction:
  jurisdiction: iso_3166_1_alpha_2   # one value only
  # no role, no evidence digest: the shape argued against
integrity_and_recorder:
  prev_hash: sha256          # AAT 6.1
  signature: ecdsa_p256|ml_dsa_65    # AAT 6.2, optional
  trust_level: L0|L1|L2|L3|L4        # AAT 3.1
retention_and_access:
  retention_months: 6|12     # AAT 9.1, 9.2
  access_class: null         # no standard field

What to record about jurisdiction, and how

The short form of the rule the previous document argues in full: carry jurisdiction as the result of a predicate, plus a digest of the evidence that produced it, and never as a location value in clear or as a bare digest of one.

Neither draft does this today. One carries a single country code with no role attached and no evidence behind it, which is a value that cannot be checked and cannot be defended. The other excludes the whole area, correctly for its own purposes and unhelpfully for this one. So the field a framework needs here is a field none of the five shapes has, and modelling it as a namespaced constraint record is the least invasive way to add it: a check with an identifier, a result, and a commitment to the evidence, sitting beside the other checks rather than in a new part of the schema.

And it has to be evaluated per party, because the operator, the provider, the deployer and the person affected are each reached by a different body of law through a different hook. One country code for the whole action answers none of those questions and looks as though it answers all of them.

What this document is not

It is not a recommendation that anyone adopt a particular draft, and nothing in the two boxes above is required by any law in the corpus. The standards named here are not law and are not counted anywhere in this analysis. What the law requires is the second document, read per jurisdiction on the third. This one asks only whether a record built to the emerging shapes would be able to show it.

1. Analysis
2. The exploration
3. Why logs
4. What is required
5. By jurisdiction
6. Locating the actor
7. For framework builders