The era of agents is here.

An agent receives work, executes an initial step, and hands off to subsequent agents down to final execution. Each handoff through the bus constitutes an attributed action, with receiving agents operating on the prior agent's verifiable record.

When a policy refusal or violation occurs, the audit record captures the exact rule and version that fired at the message boundary today. Tool-level refusals are runtime work in development.

Each recorded action is cryptographically hash-chained: every hash incorporates the prior entry's hash, so an in-place edit to a record no longer matches its hash, and your team detects it when the record is re-derived and verified.

• For wholesale-rewrite protection, the chain commits to an S3 Object Lock bucket you configure, which can live inside your perimeter; until configured, the chain is anchored internally only.
• Your auditor re-verifies against it, in your own environment, so integrity never rests on trusting the system that produced the record.
• Nothing ages out: records are retained indefinitely, though content may be redacted by policy.

Tamper-evidence is structural to the cryptographic chain, not an optional secondary feature. Modifying an event record in place breaks hash continuity, which a verification pass over that record detects. Protection against a wholesale rewrite depends on the external anchor you configure.

The substrate attributes spend directly to the specific agent, breaking out per-provider spend where the runtime reports cost, such as Claude Code today. The substrate makes spend visible and does not unilaterally cap execution.