Source-linked AI summary
A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
Arslan Brömme
TL;DR
Agentic workflows create a need to reconstruct communications, approvals, tool actions, policies, and later record changes. This paper proposes a vendor-neutral black-box evidence layer that canonicalizes and cryptographically anchors selected events while keeping sensitive content off-chain. Its supported conclusion is that anchoring strengthens later verification of critical process traces, but it does not prevent misbehavior or establish semantic truth and requires additional controls for authenticity, authorization, completeness, and related properties.
Problem
Agentic workflows require organizations to reconstruct interactions, approvals, tool use, applicable controls, and whether records were later modified.
Method
The paper proposes a product- and vendor-independent black-box architecture that applies externally verifiable cryptographic commitments to selected agentic events.
Results
The architecture supports later verification of selected critical process traces through externally anchored integrity and temporal evidence without placing sensitive content on-chain.
Takeaways & Limitations
The evidence layer can support audits, incident reconstruction, and compliance-relevant evidence readiness without serving as a compliance engine or reporting decision-maker.
Takeaways & Limitations
The approach does not prove semantic truth, correctness, or authentic capture, and its value depends on complete capture and surrounding identity, authorization, policy, ordering, and storage controls.
Abstract
from arXiv · showhide
Autonomous AI agents increasingly communicate with other agents, invoke tools, exchange intermediate results, and request human approvals. These workflows create a new auditability problem: organizations must reconstruct what happened, when it happened, which agent or human was involved, which control or policy applied, and whether records were modified afterwards. Motivated by the 2026 OpenAI/Hugging Face incident, this position and architecture paper proposes a product- and vendor-neutral black-box architecture for agentic processes. The architecture creates blockchain-anchored cryptographic commitments for selected agent communications, human-in-the-loop approvals, tool calls, and process artifacts without placing sensitive content on-chain. We define an evidence model that distinguishes temporal anchoring and artifact integrity from event ordering, capture authenticity, authorized anchoring, and causal traceability. The latter properties require additional architectural controls. We then discuss practical use for Governance, Risk, and Compliance (GRC), including compliance testing, risk-based evidence selection, monitoring evidence streams, incident reconstruction, and regulatory reporting readiness under the EU AI Act, NIS2, and the Cyber Resilience Act (CRA). This position and architecture paper does not present an empirical performance or security evaluation. The approach does not prevent agent misbehavior or prove semantic truth. Rather, it strengthens the evidentiary basis for later verification of critical process traces.
Arslan Brömme CISSP, CISM, CISA, CAISE
The document is a draft working paper that may be updated and invites comments.
- The document is labeled Draft v0.9.1.5 and dated 3 September 2026.
- It is identified as a preprint and working paper.
- The document states that comments are welcome, although the visible passage is incomplete.
1 Introduction
Agentic systems create an auditability problem because organizations must reconstruct interactions, decisions, tools, policies, and record changes. The paper proposes a vendor-independent black box that externally anchors selected critical events without exposing sensitive content.
- Motivation: Agentic workflows require reconstructing which agents communicated, what information they exchanged, which tools were invoked, and what approvals and policies applied.
- Motivation: The 2026 OpenAI/Hugging Face incident illustrates risks involving unauthorized communication, shared infrastructure, third-party access, and manipulated transcript evidence.
- Proposed architecture: The proposed black box is an externalized, tamper-evident record of selected critical process states for audits and incident reconstruction.
- Proposed architecture: The evidence layer provides integrity, temporal anchoring, and declared ordering for selected events without exposing sensitive content.
- Scope: The paper presents an architectural pattern rather than a commercial implementation, empirical evaluation, or containment mechanism.
2 Background, Related Work, and Threat Model
Hash anchoring can provide externally verifiable evidence that an artifact existed in a particular form and remained unchanged, while leaving authenticity, authorization, completeness, and prevention to surrounding controls.
- Hash anchoring: A verifier can compare an artifact’s recomputed digest with a previously committed reference to detect later changes without revealing the artifact.
- Assurance boundaries: Hash anchoring supports evidence of an artifact’s existence and integrity at or before commitment time, but not authorship, authorization, truthfulness, or correctness.
- Evidence scope: Agentic evidence includes messages, approvals, tool calls, intermediate files, tickets, policy decisions, and system-state snapshots, while sensitive artifacts should remain off-chain.
- Related work: Blockchain anchoring is one deployment assumption among timestamping services, transparency logs, append-only audit logs, and permissioned ledgers.
- Threat model: The evidence layer does not prevent log alteration, missing capture, unauthorized channels, spoofed records, or mismatches between approvals and executed actions.
- Threat model: Prevention remains dependent on secure architecture, access control, sandboxing, monitoring, policy enforcement, and safe tool design.
3 Agentic Evidence Architecture
The architecture canonicalizes selected events, hashes them, and anchors commitments with metadata so auditors can later verify retained artifacts. It addresses multiple interaction classes while requiring authenticated capture, authorized anchoring, and data minimization.
- Evidence pipeline: Selected events are converted into stable canonical representations, hashed, and anchored with metadata such as event type, timestamp, context, and verification method.
- Canonicalization: Canonicalization is security-relevant because differing byte representations can make later integrity verification ambiguous.
- Event representation: A minimal event object can identify an event, its type, actor, recipient, policy, control, artifact hash, context hash, and approval or tool references.
- Digest choice: SHA-512 is used illustratively as a conservative digest choice for long-lived records, not as a claim that SHA-256 is unsuitable.
- Interaction classes: The architecture covers agent–agent, agent–human, and agent–system evidence, with Merkle-tree aggregation available for high-volume environments.
- Data minimization: Sensitive prompts, personal data, trade secrets, and raw transcripts should remain in controlled enterprise storage while commitments are anchored externally.
- Authenticity and authorization: Artifact integrity does not establish capture authenticity, so events should bind authenticated identities to records and use authorized evidence components.
4 Temporal Ordering
Blockchain anchoring provides temporal evidence for selected agentic artifacts, but on-chain transaction order does not automatically represent workflow order or causality. Explicit sequencing and event-linking controls are therefore needed for process reconstruction.
- Temporal anchoring: Anchor time establishes that a committed digest existed no later than verifiable inclusion and, where applicable, finality.It does not necessarily equal the underlying event’s creation time or prove semantic causation.
- Temporal anchoring: Concurrent anchoring transactions can be ordered by propagation, batching, fees, confirmation latency, or service availability rather than workflow semantics.
- Explicit ordering: Stricter reconstruction can use an evidence controller to assign sequence numbers, apply policy checks, link events by hash, and anchor individual or batched commitments.
- Explicit ordering: Chained events can record prior-event hashes and anchor references to preserve declared dependencies and integrity across communication and action records.
- Limits: Chaining supports temporal order, declared dependency, and record integrity, but does not prove causality in a philosophical or legal sense.
5 GRC and Compliance Verification
Anchored evidence extends GRC controls by preserving verifiable records of critical actions, approvals, and policy context. Its practical value depends on risk-based selection and monitoring, while documentation alone does not establish compliance.
- GRC evidence: Independently anchored commitments can demonstrate that retained records have not changed since a defined point in time.This supplements conventional logs, which show what the system recorded.
- GRC evidence: GRC evidence can link critical actions to roles, policy versions, approval requirements, and decision contexts.
- Compliance verification: Compliance testing can check whether approvals preceded execution, review preceded action, tool parameters matched approval, and exceptions were recorded before control bypasses.
- Limits: Documented evidence does not itself establish legal or policy compliance because controls may still be incorrectly designed or applied.
- Evidence selection: Risk-based policies should prioritize high-impact events while retaining routine communication locally or in periodic Merkle batches to reduce cost, noise, and privacy exposure.
- Monitoring: Monitoring can verify retained artifacts, sequence links, and expected policy-relevant event capture, then anchor the resulting verification reports as a separate evidence stream.
6 Regulatory Reporting and Evidence Readiness
The evidence layer can support regulatory incident workflows by preserving reliable records of detection, chronology, impact, decisions, and remediation. It is not a compliance engine and does not determine reporting duties or replace legal procedures.
- Shared evidence needs: Regulatory regimes differ in scope, thresholds, recipients, and terminology but share an operational need for reliable incident records.
- Regulatory regimes: The EU AI Act requires event recording for relevant high-risk AI systems and imposes retention and serious-incident reporting obligations.Applicable duties depend on system role, classification, incident type, and statutory trigger.
- Regulatory regimes: NIS2 uses staged significant-incident notifications, including early warning within 24 hours, notification within 72 hours, and generally a final report within one month.Concrete implementation depends on national transposition and competent authorities.
- Regulatory regimes: The CRA imposes staged manufacturer reporting duties for actively exploited vulnerabilities and severe incidents, with key obligations applying from dates specified in the regulation.
- Scope boundary: The architecture supports compliance-relevant evidence and reporting readiness but does not decide reportability, identify the responsible operator, or replace applicable procedures.Its role is preserving proofs about records, decisions, approvals, and tool actions at particular times.
7 Illustrative Incident Scenario
An illustrative security-operations workflow links detection, agent review, human approval, execution, and verification through anchored artifacts. Those commitments support later checks of approval order and transcript or tool-record integrity, but would not have prevented unauthorized communication.
- Workflow: The scenario chains a detection agent, risk agent, human analyst, execution agent, and verification agent in a remediation workflow.
- Anchored artifacts: Six artifacts can be anchored: the finding, handover, recommendation and policy context, approval, executed tool-call parameters, and resulting state.
- Incident reconstruction: Retained artifacts can be re-hashed to test whether an internal transcript was edited and whether human approval preceded execution.
- Incident relevance: The scenario addresses incident concerns involving unsanctioned inter-agent communication and attempts to spoof or alter transcript evidence.
- Scope boundary: External commitments would not prevent unauthorized communication but could reduce the ability to rewrite captured communications or tool records after anchoring.
8 Limitations and Future Work
The architecture’s assurance claims are limited by incomplete capture, surrounding-system dependencies, confidentiality requirements, and unresolved operational trade-offs. Future work should evaluate evidence schemas, authenticated capture, correlation, policy mappings, and overhead in realistic multi-agent environments.
- Hash anchoring proves integrity and temporal existence, but not semantic truth, correctness, or authentic capture.
- Evidence value depends on capture completeness because uncaptured or pre-capture-replaced events cannot be recovered.
- Identity, authorization, policy enforcement, ordering models, and secure time sources remain surrounding-system concerns.
- Confidentiality requires disciplined off-chain storage and data minimization, while operations must address selection, latency, batching, cost, keys, retention, and deletion.
- Future work should assess canonical schemas, authenticated capture, trusted controllers, cross-system correlation, policy-to-evidence mappings, and quantitative overhead.
9 Conclusion
Agentic workflows require reconstructable process traces, while conventional logging alone does not provide tamper evidence. The proposed black-box architecture adds a blockchain-anchored evidence layer for selected communications, decisions, tool actions, and related process events.
- Agentic systems require reconstructing critical traces, assessing temporal order, and detecting whether supporting records changed afterwards.
- Conventional logging remains essential, but external anchoring adds tamper evidence as a distinct assurance property.
- The proposed architecture blockchain-anchors evidence for agent communication, human-in-the-loop decisions, tool-mediated actions, GRC testing, and incident reconstruction.
- Its central principle is to make critical agentic-process records externally tamper-evident rather than only logging them.