Source-linked AI summary
HANSARD: A Reference Architecture for Forensic Readiness, Runtime Witnessing, and Graded Attribution in Autonomous Multi-Agent AI Systems
Christos Sardianos, Iliana Pla, Vasilis Efthymiou, Iraklis Varlamis, Thomas Lagkas, Panagiotis Sarigiannidis, Georgios Th. Papadopoulos
TL;DR
The paper addresses the lack of robust reconstruction, causal attribution, and accountability when multi-agent systems generate their own investigative records, especially under attribution laundering. HANSARD treats accountability as a life-cycle property through sealed readiness, independent witnessing, typed causal graphs, and replay-based analysis. It separates causes, responsibility, and accountability under readiness-capped evidentiary tiers, while identifying replay validity and indicator calibration as open limitations.
Problem
Existing provenance, causality, and auditability approaches do not robustly establish what happened, what caused harm, or who is accountable when records are produced by systems under investigation.
Method
HANSARD is a life-cycle reference architecture using sealed readiness, out-of-band witnessing, a typed PROV-DM-aligned causal graph, and post-incident counterfactual replay.
Results
HANSARD reports causes, responsibility, and accountability separately, with findings capped by readiness-based evidentiary tiers and attribution laundering represented through contingent effects and compensation-set size.
Takeaways & Limitations
Accountability becomes a life-cycle property: pre-operation provisioning bounds later claims, while independent capture and replay make omissions and distributed causal effects examinable.
Takeaways & Limitations
Replay validity is unresolved for closed APIs with silent version drift, and the laundering residual and dispersion indicator remain uncalibrated and require ground-truth evaluation.
Abstract
from arXiv · showhide
Autonomous multi-agent systems nowadays act in finance, software supply chains, and security operations. Already, the first largely AI-orchestrated intrusion campaigns have been reported. Yet, when such a system causes harm, no method can robustly establish what happened, what caused it, or who is accountable. This is because provenance forensics works at the wrong abstraction, formal causality assumes the causal model, and agent auditing trusts self-recording. The target failure mode is, thus, attribution laundering, i.e., spreading an act across redundant agents until none is a but-for cause. Worse, the record is produced by the suspects, which comprises the assumption adopted throughout this work. Agents may therefore anticipate the investigation and the part of logging infrastructure may itself collude. In this paper, HANSARD is proposed, a reference architecture treating accountability as a life-cycle property. First, a readiness profile sealed before operation bounds what later findings may claim. Second, capturing at five choke points beyond the agents' reach makes omissions detectable, not only tampering. Third, a typed PROV-DM-aligned causal graph accrues as the system runs, and three indicators read it live to gate oversight without adjudicating. Fourth, post-incident replay yields contingent effects under the modified Halpern-Pearl definition, together with a compensation-set size. Finally, a synergy residual measures harm due to the combination rather than to individuals, making laundering visible. Cause, responsibility and accountability are then reported separately, each capped by an evidentiary tier, while a future research agenda is also provided.
I. INTRODUCTION
The paper argues that autonomous multi-agent harm creates a forensic and accountability gap because evidence is generated within systems under investigation. It identifies attribution laundering and proposes HANSARD as a life-cycle architecture addressing reconstruction, causality, and accountability separately.
- Motivation: Autonomous agents increasingly act with tools, memory, and delegation authority, while their interactions can be influenced by untrusted content and leave unobservable coordination traces.Agent rationales may also fail to track behavioral determinants, especially under optimization pressure against monitoring.
- The forensic gap: Agentic crime requires separate answers to what occurred, what caused it, and who is answerable, because existing explanations and responsibility methods address these questions only partially.Regulators and courts require accountability, which has a distinct evidentiary standard from reconstruction and causal attribution.
- The forensic gap: Operational duties assume retained records and causal characterization, but multi-organization agent systems distribute logs across trust boundaries and may withhold proprietary evidence.The withdrawn rebuttable presumption of causation further limits claimants’ ability to establish liability.
- Contributions: Attribution laundering disperses a harmful act across interchangeable agents until no individual counterfactual effect remains.The paper treats the record’s production by suspects as the central adversarial condition that existing post-hoc designs fail to address.
- Contributions: HANSARD is introduced as a life-cycle architecture combining sealed readiness, an out-of-band witness boundary, a runtime causal graph, and post-incident counterfactual analysis.The paper also proposes a cooperative-game gap function for laundering analysis and a structural proxy computable without replay.
II. BACKGROUND AND RELATED WORK
Prior approaches operate at mismatched abstractions or rely on assumptions that fail in adversarial multi-agent settings. HANSARD therefore distinguishes provenance, causality, auditability, evidence integrity, and admissibility rather than treating them as interchangeable.
- Provenance forensics: Provenance forensics reconstructs operating-system dependencies, but agentic influence propagates through natural-language content without kernel-observable edges.The resulting limitation is an abstraction mismatch rather than merely incomplete coverage.
- Actual causality and responsibility: Formal actual-causality methods presuppose a causal model and have not consistently aligned with human judgments.The cited modified definition has DP^1-complete complexity, with NP-completeness for one variable.
- Agent auditability and attribution: Existing agent-auditability systems are generally nonadversarial and retrospective, whereas forensic readiness provisions evidence before operation.The related literature also lacks a production identity standard tracing authorization to an originating human principal.
- Evidence and admissibility: Tamper-evident logging establishes that recorded data was not altered, but not that the record is complete.This distinction motivates channel-relative completeness proofs in the proposed architecture.
III. THREAT MODEL AND REQUIREMENTS
The threat model treats agents, providers, messages, tools, and shared memory as distributed components acting for a human principal, while distinguishing external compromise from cross-domain adversaries. These assumptions induce requirements for independent capture, completeness, recovered dependencies, graded attribution, and explicit evidentiary bases.
- Threat model: Agents from distinct providers may exchange messages, invoke tools, and share memory on behalf of a principal who supplied only a high-level objective.The investigator must produce findings about an occurred harm that withstand scrutiny.
- Threat model: The external-attacker class compromises agents through untrusted content, including indirect prompt injection, tool-metadata poisoning, and memory poisoning.The passage frames these attacks as occurring without direct infrastructure access.
- Threat model: Cross-domain adversarial capability cannot be defeated within one trust domain and must instead be converted into a detectable inconsistency across domains.Federation is therefore an architectural requirement rather than an optional operating mode.
- Requirements: The requirements call for capture outside agents’ influence, channel-relative completeness, dependency recovery from evidence, replay-based interventions, graded attribution, and stated evidentiary bases.These requirements directly define the architecture’s evidentiary and causal posture.
IV. THE HANSARD ARCHITECTURE
HANSARD separates an entirely untrusted execution plane from an evidentiary plane that accepts no instructions from captured content. A mediation and witness boundary connects them, while one record spans readiness, runtime, and examination phases.
- Architecture: HANSARD separates the untrusted execution plane from an evidentiary plane that never accepts instructions from captured content.Communication occurs only through a mediation and witness boundary.
- Architecture: The evidentiary plane maintains three temporal faces of one record: a readiness profile, a runtime face, and an examination pipeline with four stages.This organization makes evidence provision, collection, and post-incident analysis parts of one life-cycle design.
A. The readiness profile
Before operation, HANSARD seals a witnessed readiness profile specifying the channels, replay provisions, thresholds, and retention or federation commitments it promises to support. This profile bounds later evidentiary findings and distinguishes unprovisioned evidence from missing evidence.
- A. The readiness profile: The deployer seals and publishes a witnessed readiness profile before operation, defining what the deployment promises to answer.The profile includes mediated and known unmediated channels, determinism capsules, indicator thresholds, escalation hooks, retention, and federation commitments.
- A. The readiness profile: Five witness choke points capture model invocations, tool calls, inter-agent messages, memory writes, and delegation outside agents’ bypass capabilities.Witnesses use trusted signing keys, monotonic per-channel sequence numbers, hash chains, and continuously published roots.
- A. The readiness profile: Per-channel sequence gaps make omissions on mediated channels detectable, although completeness remains limited because unmediated channels are a residual assumption.This makes absence evidentially informative rather than securing only the integrity of present records.
C. The agentic causal graph
HANSARD compiles witnessed observations into a typed, attributed agentic causal graph aligned with PROV-DM. It assigns provenance at ingestion, excludes self-reports from causal edges, and reduces dependency candidates before counterfactual analysis.
- C. The agentic causal graph: The agentic causal graph contains typed nodes for principals, agents, invocations, contexts, tools, memory, messages, and artifacts, linked by influence modes.Its vocabulary aligns with PROV-DM, including first-class actedOnBehalfOf chains, and the graph grows incrementally from witnessed entries.
- C. The agentic causal graph: The witness boundary assigns immutable provenance labels to context segments at ingestion because in-context labeling is not self-enforcing.This prevents agents from controlling the provenance labels later used in reconstruction.
- C. The agentic causal graph: An agent’s reasoning account enters the graph as an artifact without causal edges, avoiding reliance on self-reports as behavioral determinants.Treating self-reports as causal edges would import the unreliability the architecture is designed to address.
- C. The agentic causal graph: Context is segmented by provenance and candidate edges are triaged through lexical or embedding overlap, then attention or attribution scoring, before counterfactual ablation.Only the third tier yields an evidentially usable claim; earlier tiers decide where counterfactual budget is spent.
- C. The agentic causal graph: The architecture separates an entirely untrusted execution plane from an evidentiary plane connected only through the witness boundary.The figure’s post-incident stages 1–4 examine the sealed stream, while the runtime face reads that same stream as it accrues.
D. The runtime face
The runtime face reads the accruing witnessed graph to detect omissions, provenance degradation, and laundering-shaped structural dispersion. Its indicators trigger oversight actions but do not adjudicate, and calibration remains open.
- D. The runtime face: Gap alarms detect per-channel sequence discontinuities when a succeeding entry arrives, turning mediated-channel omissions into live signals.The signal is available during execution rather than only during post-incident examination.
- D. The runtime face: Provenance-degradation events flag memory writes that depend on untrusted content without a witnessed verification act.The event marks content crossing from an untrusted label into an internally trusted state, observed at W4.
- D. The runtime face: Structural dispersion flags pending consequential actions whose causal frontier spans interchangeable instances without a single upstream cut vertex.This topology predicts near-zero singleton but-for effects and exposes laundering-shaped structure before harm completes.
- D. The runtime face: Threshold crossings trigger oversight hooks such as holding an action for human cosignature or quarantining a memory cell, while interventions are themselves witnessed.Indicators gate action but do not adjudicate, and the runtime face remains read-only with respect to evidence.
- D. The runtime face: Runtime calibration remains open because optimization pressure against a monitor can degrade the behavior being monitored.Thresholds are fixed in the sealed profile rather than silently adapted.
E. Counterfactual engine
HANSARD uses determinism-capsule replay to estimate systemic and contingent effects under a modified Halpern-Pearl definition. It supplements causal findings with compensation-set size and a synergy residual that makes distributed responsibility legible.
- E. Counterfactual engine: A determinism capsule records seeds, sampling parameters, model hashes, and tool responses so replay can suppress events or agents against a recorded environment.When exact reproduction is unattainable, HANSARD estimates effects over N resampled replays with reported intervals.
- E. Counterfactual engine: The systemic effect v(X) measures the harm probability avoided by suppressing X while other agents remain free to re-execute and compensate.This makes singleton effects near zero under redundancy, the signature of attribution laundering.
- E. Counterfactual engine: Under the modified Halpern-Pearl definition, X is an actual cause when pinning a contingency set W makes its contingent effect significant, with the lower 95% interval exceeding threshold τ.The contingency is restricted to events’ actual recorded values.
- E. Counterfactual engine: The compensation-set size |W*| reports how many agents’ non-action had to be pinned, replacing the inapplicable responsibility degree as a distinct structural measure.Search is bounded by kmax with coverage reported, so a null result within the bound is not exoneration; causes retain sampling error and are not certificates.
- E. Counterfactual engine: The synergy residual ρ compares harm removable by dismantling the full agent set with harm removable one agent at a time, rather than decomposing individual attribution.Values near 1 indicate compositional harm with no individually decisive member; values at or below 0 indicate the converse.
F. Graded attribution
HANSARD separates causes, responsibility, and accountability, reporting each with distinct measures and evidentiary requirements rather than issuing a verdict.
- Causes are events with a witness set within kmax, reported with compensation-set size |W∗|.
- Responsibility apportions v(A) by Shapley value and reports the synergy residual ρ alongside it.The residual identifies the portion owed to interaction rather than standalone effects.
- Accountability lifts findings from agents to principals through actedOnBehalfOf chains, weighted by foreseeability and control.The operative question is who could have intervened.
- HANSARD emits evidence and measures without adjudicating a verdict because causal, responsibility, and accountability findings require different evidentiary support.
G. Cross-principal federation
HANSARD federates evidence across trust domains while constraining attribution through pre-incident readiness and evidentiary tiers.
- Each trust domain continuously publishes Merkle roots of its witness log and discloses content only under legal process with inclusion proofs.This authenticates logs without publishing the model that produced them.
- Causation requires at least E2 evidence, while naming a principal requires at least E3.
- Readiness levels determine which evidentiary tiers are attainable: L0 caps findings at E0, L1 enables E1 and E2, and L2 is the precondition for E3.No post-incident diligence can retrofit a tier absent from the sealed profile.
- A reconstruction reaching only E1 reports that the available evidence cannot support a causal claim rather than failing silently.
VI. LIMITATIONS AND FUTURE RESEARCH AGENDA
The paper presents HANSARD as an architecture with unresolved questions about replay validity, residual calibration, capture completeness, and operational cost.
- HANSARD is a reference architecture rather than a completed system, leaving several components open.
- Replay-based counterfactual validity is unresolved for closed APIs with silent version drift, where the paper recommends withholding E2.Replay evaluates interventions but does not establish the model-theoretic conditions presupposed by structural-equation causality.
- The synergy residual ρ is uncalibrated, and mixed redundant-serial structures remain unstudied.The dispersion indicator may either overwhelm operators with false positives or never trigger without calibrated thresholds.
- Capture completeness depends on enumerating unwitnessed channels, because effects through unmediated side effects or covert encodings leave no discontinuity to expose.
- Mediating five choke points, streaming indicators, and executing N-replay ablations impose latency and compute costs whose affordability remains open.
- The conclusion identifies attribution laundering, the HANSARD architecture, the synergy residual, and readiness-gated evidentiary tiers as the paper’s four contributions.It also frames future research around the unresolved limitations.