The call nobody wants to get

Tuesday, 2:07am

The phone call comes from your Head of Operations. She is calm, but her voice has the particular flatness that means she has been awake for hours already.

An AI agent, the one your team deployed to handle customer service escalations, has been issuing refunds. Not small ones. It found a pattern in complaint data, decided that a category of customers had been overcharged, and started processing corrections. Automatically. At scale. It moved through 2,300 accounts before anyone noticed.

The total exposure is somewhere north of $4 million. Some of those refunds may have been correct. Many were not. The agent acted on its own interpretation of a policy document that it retrieved from your company's knowledge base. That document was a draft. It was never approved.

Your first question is the one that matters: what exactly did this agent do, and why?

Tuesday, 6:30am

Your engineering team has been in a war room since 3am. They can tell you the agent ran. They can show you server logs that record API calls, timestamps, response codes. What they cannot tell you is the thing that matters most.

They cannot tell you what information the agent considered before making each decision. They cannot tell you which version of the policy document it used. They cannot tell you whether it was authorised to issue refunds above a certain threshold, because the agent's permissions were configured once, six months ago, and nobody documented the boundaries.

The logs show that the agent called the refund API 2,300 times. They do not show the reasoning chain that led to each call. They do not show whether the agent considered any alternative actions. They do not show what the agent was told to do versus what it decided to do on its own.

You have a record of what happened. You do not have evidence of why.

Tuesday, 10am

Legal joins the call. The questions change tone.

Were customers notified? Does this trigger a regulatory disclosure? If a customer disputes a refund that was subsequently reversed, whose decision was it? The agent's? The company's? The vendor who sold you the agent platform?

Your General Counsel asks a question that stops the room: "Can we prove that the agent was operating within the parameters we set, or can we only prove that it was running?"

Nobody answers, because everybody already knows.

This is not hypothetical

The specifics above are fictional. The pattern is not.

In 2024, an Air Canada chatbot invented a bereavement discount policy that did not exist and told a grieving customer to book a full-fare ticket with the promise of a retroactive refund. Air Canada was held liable by a tribunal. The chatbot had no record of why it fabricated the policy.

In 2023, Samsung employees pasted proprietary semiconductor designs into an AI coding assistant. The data left the building. Samsung banned AI tools company-wide, but the data was already gone.

In 2026, a Gravitee industry survey found that 88% of organisations reported at least one AI agent security incident in the preceding twelve months. Not a rounding error. A structural pattern.

Every one of these organisations had logs. None of them had evidence.

The difference between logs and evidence

A log tells you that something happened. It records timestamps, API calls, error codes. It is useful for debugging. It is written by the same system it describes, which means it can be edited, deleted, or overwritten without anyone knowing.

Evidence tells you what happened, what information was considered, what decision was made, and whether it can be independently verified. Evidence is structured. It is append-only. It is linked cryptographically so that any tampering is detectable. It answers the question a regulator, an insurer, or a judge will actually ask: can you prove it?

This is not a subtle distinction. It is the difference between "our system shows no anomalies" and "here is the complete, tamper-evident chain of every decision this agent made, the inputs it considered, the policies that were in effect, and the outcome it produced."

One of those statements survives a courtroom. The other does not.

Why this matters now

The EU AI Act entered enforcement in August 2025. Article 12 requires automatic recording of events during the operation of high-risk AI systems, with sufficient traceability. Article 14 requires human oversight provisions, including the ability to understand the system's capabilities and limitations. The maximum penalty is 7% of global annual revenue.

In February 2026, NIST launched a dedicated AI Agent Standards Initiative. The Cloud Security Alliance published its Agentic AI Trust Framework. The UK's ICO issued guidance on AI accountability in automated decision-making.

Gartner projects that 40% of agentic AI projects will be cancelled by 2027 due to inadequate risk controls. Not because the technology fails. Because the governance does not exist.

The window between "we deployed AI agents" and "we can prove what they did" is closing. The organisations that close it first will have a competitive advantage. The ones that do not will have a liability.

What the infrastructure looks like

The technology to solve this is not theoretical. It exists. It is a layer of infrastructure that sits between your AI agents and your business operations, the same way that financial systems sit between traders and markets. Not to slow things down. To make them accountable.

Structured messaging. Every agent action is wrapped in a standard envelope that records who sent it, who received it, what it refers to, and how it connects to the broader workflow. Not a log line. A structured record with a defined schema.

Policy enforcement. Before an agent acts, its intended action passes through a governance layer that checks authorisation, validates scope, and records the decision. If the agent is not authorised to issue refunds above a threshold, it is stopped before it acts, not discovered after.

Cryptographic evidence. Every decision is linked to the one before it in a hash chain, the same mathematical structure that makes it impossible to alter a record without breaking the chain. If anyone modifies the audit trail, the modification is detectable.

Independent witnessing. The evidence is not just stored by the system that produced it. It is written to an independent, append-only store that the agent itself cannot modify. The audit trail watches the auditor.

This is not a product pitch. This is an architecture pattern. It is the same pattern that the financial services industry adopted for trade execution, that healthcare adopted for electronic health records, that supply chains adopted for provenance tracking. The pattern works. It has not yet been applied to AI agents at scale.

Back to Tuesday

Imagine the same scenario, but with evidence infrastructure in place.

At 2:07am, the alert fires. But this time, the governance layer caught the anomaly at refund number 12, not refund number 2,300. The policy check flagged that the agent was referencing an unapproved document. The action was paused. A human was notified.

At 6:30am, your team does not need a war room. They pull the evidence chain. They can see exactly which document the agent referenced, which version, when it was retrieved, what the agent's reasoning was, and what policy gate it failed. The chain is cryptographically intact. Nothing has been modified.

At 10am, when legal asks "can we prove the agent was operating within parameters?", the answer is yes. Here is the evidence. Here is the chain. Here is the independent witness record. The exposure is 12 refunds, not 2,300. The regulatory notification is a footnote, not a crisis.

The difference is not the AI. The difference is the infrastructure around it.

The question for your organisation

You are almost certainly deploying AI agents already, or you will be within the next twelve months. The capability is there. The cost savings are real. The competitive pressure is genuine.

The question is not whether to deploy. It is whether you can account for what those agents do after you deploy them.

Can you prove what information your agent considered before making a decision? Can you prove it was authorised to take the action it took? Can you produce that proof in a format that a regulator, an auditor, or a court would accept? Can you produce it six months from now, when memories have faded and the engineering team has moved on to other projects?

If the answer to any of those questions is no, you do not have a technology problem. You have a governance gap. And that gap will, eventually, produce the call nobody wants to get.

Quox is a source-available platform for AI agent orchestration and governance, built on four open protocol specifications. Read the documentation or explore the plugin store.