The era of agents is here.

An agent receives the work, hands off to the next agent, which hands off again, down to the agent that records the outcome. Each handoff is itself an action that needs attribution, and each receiving agent decides on the previous agent's record. The seam between agents is where the work actually lives, and the seam is what coordination governs.

• The chain is legible at every link: which agent acted, which received, in what order, on which data, under which policy.
• Handoffs carry the record forward. The receiving agent inherits the audit context the prior agent emitted, not a summary of it.
• Branching is governed. When a decision splits into parallel actions, every branch is tracked as an attributed action of the agent that branched.
• Multi-agent dependencies surface where the work crosses. Asking which agent did this gets an answer, not a guess.

The policy that authorizes an agent action is not a slide, a wiki page, or a guardrail that catches mistakes after the fact. It is code, reviewed by your team, deployed alongside the substrate, and enforced at the decisional event by the substrate itself. The agent does not run the action; the substrate runs the action when the policy permits it.

• Reviewable: pull-request review by your model-risk, compliance, and security functions. The version that authorized an action is the version the auditor reads.
• Testable: the substrate runs the policy against representative actions before it lands. Coverage of the decision space is a property of the policy.
• Enforced where the action happens: not at an API gateway, not at a dashboard watching afterward, but at the moment of action.
• The refusal is the record: a refused action is an attributed audit event showing the agent that attempted, the policy that refused, and the conflict.

Each recorded action is hashed into a chain whose continuity an auditor can prove was not altered, from the first record to the current state. Operators cannot rewrite the record. Agents cannot rewrite the record. The substrate cannot rewrite the record.

• Hash-chained at write: each action's hash includes the prior action's hash, so the chain verifies from any point back to the start.
• Retention that satisfies the audit window, held for the required retention period, not at the operator's discretion.
• Integrity is provable, not asserted: the verification is something an auditor runs, not something the operator certifies.
• The record is the action. There is no separate logging layer to fall behind or drop fields. The substrate does not run unless the record is captured.

Tamper-evidence is a property of how the chain is built, not a feature added on top. Any modification to a recorded action, to the substrate that holds the chain, or to a system upstream of it produces a chain that does not verify. The auditor running the verification sees the failure.

• Alteration of a recorded action breaks the chain; the verification fails.
• Alteration of the substrate that holds the chain breaks the chain; the verification fails.
• Alteration upstream (the agent, the policy, the data) is itself a recorded action, attributable to whoever caused it.
• It is built to be auditable not because the operator is trusted, but because the auditor trusts no operator.