An agent claim is auditable only when the verdict is predeclared
A new preprint turns vague promises such as “every action is logged” into claim contracts: policy, scope, records, writers and a decision rule fixed before evaluation.
What happened
Researchers proposed a formal framework for deciding whether common claims about AI agents can be audited and applied it to six claim patterns plus a worked case.
Why it matters
A log archive does not by itself settle a claim. Buyers and operators need to know in advance which evidence would pass or fail the assertion and whether the record covers the action that matters.
Auditable Claims about AI Agents, posted on 5 October, defines a claim as auditable only when its policy, scope, records, record writers and decision rule are fixed before a verdict and the required records can be obtained. The authors adapt assurance-engagement preconditions, apply a claim-check table to six common assertions and follow one assertion through five evidence states.
The paper adds three agent-specific conditions. A material action needs independent record coverage rather than only the agent's own account. Authorization must bind to the action's arguments, not merely show that a tool was generally available. Completeness must be addressed separately from integrity: an unaltered log can still omit the event that would disprove a claim. Under the paper's explicit model, the authors prove that support is impossible without each condition where its hypotheses hold.
This is a preprint and a proposed framework, not evidence that organisations using it suffer fewer incidents or pass external audits. The author-maintained companion repository improves inspectability of the artefacts but is not an independent replication. The paper also cannot make an unavailable record obtainable or decide whether a policy is normatively acceptable.
Write the verdict rule before collecting logs
Convert one operational promise into a claim contract. Name the actor and action, the time and system boundary, every record needed to support or refute the claim, who can write each record, and the exact pass, fail and inconclusive rules. Include a coverage check for actions that bypass the normal path. Then run the contract against a deliberately incomplete trace and an unauthorized-argument case.
Do not approve the claim because a dashboard is green or because a cryptographic digest matches. A useful readiness test is narrower: can a reviewer reach the same verdict from the declared evidence, including an inconclusive verdict when coverage is missing? Link the resulting control to the human-in-the-loop AI skill, but keep human approval itself as a separate claim requiring its own records.