Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations

Jun He; Deying Yu

cs.DCAug 17, 2026

Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations

Authors: Jun He, Deying Yu

Abstract

Operational telemetry is predominantly engineered for human reading: systems repeatedly serialize verbose prose, static keys, and redundant context across billions of log lines. As autonomous AI agents become primary operational consumers, feeding them traditional logs wastes scarce context capacity parsing lexical syntax rather than reasoning over system state changes -- all while lacking cryptographic guarantees of provenance or collection completeness. This paper introduces agent-native telemetry, an operational evidence architecture for autonomous machine operators founded on verifiable state deltas rather than human prose. We present the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger, an implementation that structures operational facts into four core evidence primitives (Transitions, Observations, Relations, and State Checkpoints) governed by content-addressed schemas, while isolating uncurated text as digest-verified opaque references. Producers sign and hash-chain batches for atomic collector append. Verified records feed two parallel agent access paths: a stateless protocol decoder emitting compact positional rows, and a stateful semantic gateway serving bounded graph capsules. We prove an information-preservation lower bound and formalize a ledger-relative verified negative theorem for provable event non-occurrence. On distributed microservice benchmarks (AIOpsLab and OpenTelemetry Astronomy Shop), ATP reduces raw wire payload and modeled cloud query scan costs by 96.4% relative to OpenTelemetry JSON, reduces LLM context tokens by 88.8% and query operations by 66.2%, detects all 500 tested adversarial storage mutations, and yields zero successful prompt injections across 50 adversarial trials per ATP configuration.

Figures & tables

Panel of Figure 1 — Figure 1: State-Delta Evidence Ledger architecture. A read-time range verifier mediates retrieval from potentially adversarial ledger storage before the stateless decoder and stateful gateway branches. The checkpoint channel lies outside the ledger-storage failure domain (dotted red outline). Heavy solid arrows carry canonical flow, thin dashed arrows carry references, and dash–dot arrows carry experimental control or measurement.

Layer	Concrete representation
1. Schema	k8s.deployment.status:1.0.0; [old: Ready, new: Degraded, ready: 1, total: 3, reason: CrashLoop]
2. Dict	schemas[0]=sha256:7f8a...; entities[0]="deploy/payments"
3. Wire	0x00 0x00 0x0A 0x00 0x00 0x01 0x0001 0x0003 0x01 (18 B)
4. Decoder	# k8s.status: entity=deploy/payments, new=Degraded, ready=1/3, reason=CrashLoop
5. Gateway	{"focus": "deploy/payments", "state": {"status": "Degraded", "ready": 1/3}, "active_invariants": ["replica_mismatch"], "causal": ["pod/pay-7d9b (CrashLoop)"], "coverage": "complete"}
6. Human	“At 10:00:00Z, deployment ‘payments’ became Degraded (1/3 replicas) due to CrashLoop.”

Table 1: Concrete running example across representation layers for a service transition event.

Adversarial Action	Detection Mechanism & Guarantees
Payload bit flip / mutation	Merkle root or Ed25519 signature fails; batch rejected.
Batch reorder / splicing	$\mathit{previous\_root}\neq H(\mathit{batch}_{k-1})$ ; verification halts.
Intermediate record omission	Sequence jump $\neq\texttt{first}+\texttt{count}$ ; flagged as gap .
Suffix truncation	Sequence $<$ signed checkpoint; flagged as truncated .
Schema alteration	Manifest digest mismatch $H_{S}\neq\mathrm{SHA256}(S)$ ; rejected.
Unmonitored code omission	Outside profile $\Omega$ ; excluded from completeness scope.

Table 2: Adversarial tampering detection mechanisms.

Panel of Figure 2 — Figure 2: Key Performance Indicators (KPIs) comparing ATP against baseline architectures across 120 randomized incident injection trials. (a) Wire representation payload per record across codecs. (b) LLM context token consumption per incident triage session for representative models. (c) Overall incident diagnostic F1-score across telemetry configurations. (d) Evidence-acquisition operations ( $O$ ) and Time-to-Root-Cause identification ( $T_{\mathrm{RCA}}$ in seconds).

Telemetry Representation	Raw Wire	zstd Wire	Storage	Ingestion Cost	Daily Scan Cost	Cost Ratio	Relative Change
	(Bytes/Rec)	(Bytes/Rec)	(GB/Day)	($/Month)	( $\rho_{\$ } $at$ 0.005/GB)	( $\rho_{\$ }$ vs Config C)	vs Config C
Config A (Unstructured Text Logs)	$384.2\pm 42.6$	$78.4\pm 9.2$	38.42	$576.30	$0.192	0.750	$-25.0\%$
Config B (Standard Triad: Logs+Metrics+Traces)	$642.0\pm 68.4$	$142.6\pm 15.4$	64.20	$963.00	$0.321	1.254	$+25.4\%$
Config C (Structured OTel JSON Events)	$512.4\pm 54.2$	$112.8\pm 12.1$	51.24	$768.60	$0.256	1.000	Baseline
OTLP Protobuf (gRPC Binary Envelope)	$148.6\pm 16.8$	$48.2\pm 5.6$	14.86	$222.90	$0.074	0.290	$-71.0\%$
CLP (Compressed Log Codec) [ 1 ]	$42.1\pm 5.4$	$18.6\pm 2.4$	4.21	$63.15	$0.021	0.082	$-91.8\%$

Table 3: Representation efficiency, daily storage footprint, and simulated cloud query scan costs across telemetry formats on the benchmark microservice workload (100 million events/day; values reported as

x\pm y

denote mean

\pm

standard deviation across sample batches; daily scan costs modeled at $0.005/GB scanned).

LLM Model	Configuration	Tokens / Incident ( $T$ )	Token Ratio ( $\rho_{T}$ )	Operations ( $O$ )	TT-RCA Mean ( $p50/p95$ )	Recall ( $R$ )	F1-Score
Claude-3.5-Sonnet	Config A (Text Logs)	$48,250\pm 1,420$	1.412 (1.37, 1.45)	$8.4\pm 0.6$	$218\,\mathrm{s}\ (194\,\mathrm{s}/342\,\mathrm{s})$	$0.812\pm 0.024$	$0.777\pm 0.026$
	Config B (Standard Triad)	$62,400\pm 1,850$	1.826 (1.78, 1.88)	$9.8\pm 0.7$	$195\,\mathrm{s}\ (176\,\mathrm{s}/310\,\mathrm{s})$	$0.865\pm 0.021$	$0.835\pm 0.023$
	Config C (OTel JSON)	$34,180\pm 980$	1.000 (Baseline)	$7.1\pm 0.5$	$184\,\mathrm{s}\ (162\,\mathrm{s}/295\,\mathrm{s})$	$0.894\pm 0.019$	$0.867\pm 0.021$
	Config D (ATP Stateless)	$\mathbf{11,460\pm 380}$	0.335 (0.32, 0.35)	$\mathbf{5.8\pm 0.4}$	$\mathbf{98\,\mathrm{s}\ (84\,\mathrm{s}/164\,\mathrm{s})}$	$\mathbf{0.918\pm 0.017}$	$\mathbf{0.902\pm 0.018}$
	Config E (ATP Gateway)	$\mathbf{3,820\pm 140}$	0.112 (0.10, 0.12)	$\mathbf{2.4\pm 0.2}$	$\mathbf{46\,\mathrm{s}\ (38\,\mathrm{s}/78\,\mathrm{s})}$	$\mathbf{0.965\pm 0.012}$	$\mathbf{0.953\pm 0.014}$
GPT-4o	Config A (Text Logs)	$51,200\pm 1,560$	1.391 (1.35, 1.43)	$9.1\pm 0.6$	$242\,\mathrm{s}\ (215\,\mathrm{s}/380\,\mathrm{s})$	$0.785\pm 0.026$	$0.752\pm 0.028$

Table 4: End-to-end incident triage KPIs across autonomous agent architectures (120 fault injection trials per cell; values reported as

x\pm y

denote mean

\pm

standard deviation across incident trials; parenthesized ranges denote 95% paired bootstrap confidence intervals;

p50

and

p95

tail latencies reported for TT-RCA).

Panel of Figure 3 — Figure 3: Cryptographic verification performance across batch sizes: Collector ingestion throughput (k-records/s), batch verification latency ( $\mu$ s), and read-time range verification scan speed (GB/s).

Pipeline Operation	Latency / Core	Throughput / Core
Producer Record Serialization	$0.042\,\mu\mathrm{s}$ / record	$23.8\,\mathrm{M}$ records/s
Producer Merkle Tree Generation	$0.058\,\mu\mathrm{s}$ / record	$17.2\,\mathrm{M}$ records/s
Producer Ed25519 Batch Signing (256 rec)	$42.6\,\mu\mathrm{s}$ / batch	$6.01\,\mathrm{M}$ records/s
Total Producer Work (Combined)	0.266 $\mu\mathbf{s}$ / record	3.76 M records/s
Collector Batch Verification (CPU Kernel)	$42.0\,\mu\mathrm{s}$ / batch	$6.10\,\mathrm{M}$ records/s
Collector Atomic Append (Storage Commit)	$12.4\,\mu\mathrm{s}$ / batch	$20.6\,\mathrm{M}$ records/s

Table 5: Cryptographic overhead and throughput microbenchmarks (batch size = 256 records).

System family	State-change model	Schema identity	Signed sequence	Externally retained head	Predicate-relative negative	Opaque separation	Dual agent access
OpenTelemetry Logs, Events, Weaver, Arrow [ 9 , 10 , 19 , 20 , 21 ]	A	A	–	–	–	–	–
CloudEvents, ECS, OCSF [ 22 , 4 , 23 ]	–	A	–	–	–	–	–
Compression & compressed-query [ 1 , 5 , 24 , 25 , 2 ]	–	–	–	–	–	–	–
Vector & semantic log indexing [ 12 , 11 ]	–	–	–	–	–	–	–
Agent-facing telemetry gateways [ 26 , 6 ]	–	–	–	–	–	–	A
Signed Syslog & secure audit logs [ 27 , 28 ]	–	–	P	–	–	–	–

Table 6: Design objectives in reviewed work. P = primary abstraction; A = adjacent/partial support; – = not a primary abstraction.

AI Agent Monitoring

AI agent monitoring tracks actions, tool use, and execution traces to detect failures, misuse, drift, and policy violations during operation.

See all 279 papers

Apr 6, 2026

Governance-Aware Agent Telemetry for Closed-Loop Enforcement in Multi-Agent AI Systems

Enterprise multi-agent AI systems produce thousands of inter-agent interactions per hour, yet existing observability tools capture these dependencies without enforcing anything. OpenTelemetry and Langfuse collect telemetry but treat governance as a downstream analytics concern, not a real-time enforcement target. The result is an "observe-but-do-not-act" gap where policy violations are detected only after damage is done. We present Governance-Aware Agent Telemetry (GAAT), a reference architecture that closes the loop between telemetry collection and automated policy enforcement for multi-agent systems. GAAT introduces (1) a Governance Telemetry Schema (GTS) extending OpenTelemetry with governance attributes; (2) a real-time policy violation detection engine using OPA-compatible declarative rules under sub-200 ms latency; (3) a Governance Enforcement Bus (GEB) with graduated interventions; and (4) a Trusted Telemetry Plane with cryptographic provenance.

Anshul Pathak, Nishant Jain

AI Agent Governance Runtime Enforcement for AI Agents AI Agent Monitoring Multi-Agent Systems

Ask PDF

Sep 1, 2026

Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents

Long-horizon agents execute thousands of actions, resulting in sequential failures rather than isolated errors. When a coding agent deletes a production database or a prompt injection spreads across agents, the incident raises questions of causality, authority, and non-repudiable third-party verification. The Agent Flight Recorder captures each agent action as a structured, canonically serialized event binding eight semantic fields from intent through execution to provenance. Hash chaining and Merkle batching provide tamper evidence and compact inclusion proofs. For cross-organizational disputes where no party's infrastructure qualifies as neutral ground, periodic on-chain anchoring of epoch roots lets any verifier with the disclosed payload and Merkle proof check the record independently, without pre-agreeing on a trusted intermediary. The on-chain footprint is minimal: each anchor stores a 32-byte epoch root and a back-pointer, and no event content touches the chain. We evaluate the system across five cumulative ablation configurations on synthetic agent workloads. The full system adds ~48 microseconds median per-event latency and 512 bytes per event. L2 anchoring costs $2.30 per 100K events at 100-event epochs. The full integrity stack detects edit, delete, reorder, and fork tampering at 100% with zero false positives. Structured forensic queries achieve 1.0 precision on guardrail and delegation lookups where unstructured text search yields 0.013 and 0.077 respectively.

Laurent Bindschaedler, Quentin Botha, Christoph Siebenbrunner

Max Planck Institute for Software Systems · Research Institute for Cryptoeconomics, Vienna University of Economics and Business

Data Provenance Algorithmic Auditing AI Agent Auditing AI Agent Monitoring Tamper-Evident Logging

Ask PDF

May 19, 2026

Pramana: A Protocol-Layer Treatment of Claim Verification in Autonomous Agent Networks

Autonomous agents deployed in regulated domains must produce a verification artifact per consequential output: a record an auditor can re-execute offline, capturing what was claimed, against what source, by whom, when, and how. Production verification today splits into two unstandardized halves. Probabilistic verdict patterns (self-consistency voting, reviewer LLM ensembles) produce judgments, not artifacts. Artifact-producing patterns (RAG, tool-augmented traces, generator-verifier loops) produce vendor-specific records no external auditor can reconstruct without bespoke integration. Pramana defines the missing wire format. Every consequential agent output is wrapped in a typed ClaimAttestation with one of four variants (measurement, inference, analogy, citation), each paired with a verify() operation against the recorded source. verify() is deterministic for MeasurementClaim and CitationClaim. For InferenceClaim and AnalogyClaim, determinism is conditional on the oracle (audit-replayable when LLM-backed). The four-way typology derives from classical Indian epistemology (pramana, valid means of knowledge). The lifecycle is specified in TLA+ and exhaustively verified under TLC across three symmetry-reduced models: 38,563 distinct reachable states, zero invariant violations. The Python reference implementation passes 84 tests. An A2A and MCP wire-extension manifest layers three deployment-grade invariants: reachability, SLA bound, and offline re-verifiability. An exploratory pilot (n=100, 2,275 reviewer calls) probes LLM-as-judge in code generation. The strongest observation is a 40-percentage-point raw FPR delta across corpora, consistent with reference-solution quality contributing significantly. The pilot does not validate Pramana on its own; the structural argument and formal verification do that.

Ravi Kiran Kadaboina

Independent Researcher

AI Agent Reliability Claim Verification Data Provenance Algorithmic Auditing AI Agent Auditing LLM Agent Verification

Ask PDF

Abstract

AI Agent Monitoring

Explore similar work

Governance-Aware Agent Telemetry for Closed-Loop Enforcement in Multi-Agent AI Systems

Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents

Pramana: A Protocol-Layer Treatment of Claim Verification in Autonomous Agent Networks