Agentic process evidence adds signed attestations to AI‑generated code

A research paper posted to arXiv titled “Agentic process evidence” proposes a signed attestation system for AI‑generated code changes. It matters because AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle, yet traditional git logs capture only the resulting diff, leaving no record of which model or tools performed the work.

AI agents are autonomous team members, but unlike human engineers, they are ephemeral: their reasoning, decisions, and tool calls vanish the moment the session ends. Modern security incidents involving intent mismatch or injection are becoming increasingly common, forcing us to address AI agents as an insider threat. No widely adopted standard yet enables agentic provenance and governance, and it is obvious that you cannot hold an ephemeral process accountable. The git log was designed for human commits; it shows what changed but does not show what an AI agent did, which model it used, which tools it called, or whether anyone was accountable for the outcome. Every governance framework, every audit trail, and every compliance control in the SDLC was built around one assumption: a human made the decision. That assumption no longer holds.

This shift introduces three main procedural problems: supply‑chain vector, because the agentic coder is software and thus a supply‑chain security risk; policy guardrails, to ensure the agentic coder complies with organizational policies; and task‑alignment, to keep the agentic coder focused on intended goals. The paper introduces Agentic Process Evidence (APE), a signed, tamper‑evident, machine‑readable attestation of agentic processes that links sessions to their outcome through process‑aware logging. APE enables Policy‑as‑Code control over agentic processes, allowing for human in the loop only when needed. The protocol supports the in‑toto style attestation framework and is aligned with relevant regulations.

The system consists of four components. First, the agent‑runtime side records a session log while the AI agent executes, capturing the model identifier, the sequence of tool invocations, and the decisions made during the session. Second, the runtime creates a process‑evidence object by cryptographically signing the session log, producing a tamper‑evident attestation that binds the log to the resulting artifact. Third, the registry side stores each attestation in a searchable store that downstream tools can query. Fourth, the gating system side intercepts actions such as pull‑request merges or infrastructure deployments, retrieves the corresponding attestation from the registry, and evaluates it against organizational policies through a semantic‑policy integration layer that maps attestation fields to policy predicates.

The key design decision is the use of a digital signature to make each attestation tamper‑evident and machine‑readable. By signing the log before the session ends, the system guarantees that any later verifier can detect alterations. This decision requires the agent runtime to perform a cryptographic operation and to possess a private key for signing. The trade‑off is added computational overhead and the operational burden of secure key storage and rotation, which falls on the agent‑runtime infrastructure. In return, auditors and compliance systems gain a reliable provenance record that includes the model used, the tools called, and the exact decisions that produced the code change.

The outcome is possible because sessions are inherently transient: without a mechanism to capture and preserve session data before termination, no downstream system can reconstruct who or what performed the action. The design assumes that agents can be instrumented to emit logs in real time and that the runtime environment can safely manage signing keys. The system’s effectiveness hinges on these assumptions holding across diverse deployment environments.

The paper leaves open how organizations will ensure that the signing keys used by many distributed agent runtimes remain trustworthy and auditable without introducing bottlenecks that defeat the agents’ autonomy.