RelLedger: Relational Information Governance for LLM Agent Organizations

Junxi Huang; Wenshuo Chen; Nuoxuan Li; Kailong Wang; Meitong Shen; Yuehan Kou; Leihao Zhao; Yutao Yue

cs.MAOct 12, 2026

RelLedger: Relational Information Governance for LLM Agent Organizations

Authors: Junxi Huang, Wenshuo Chen, Nuoxuan Li, Kailong Wang, Meitong Shen, Yuehan Kou, Leihao Zhao, Yutao Yue,

Organizations: Xidian University · The Hong Kong University of Science and Technology (Guangzhou)

Abstract

In LLM agent organizations, shared records determine which facts are available for later decisions. A sender consults interaction histories before deciding whether to report an event. A delivery gap across histories does not show whose relationship drove the choice or whether the resulting record matters downstream. We introduce RelLedger to audit these links. It holds the event, evidence, risk, and message fixed while crossing the sender's histories with the event target and an unrelated actor. Role reassignment and history rewrites locate the controlling cue. Message and cost interventions show when the effect appears. An attribution ledger maps each claim to its required response cells and separates missing interventions from sampling uncertainty. Recipient replay follows delivered information into downstream decisions. Executable workflows for a simulated one-person company extend the audit to retrieved histories, tool calls, and shared ledger updates. Across GPT, Gemini, Claude, DeepSeek, and Qwen, the audit reveals model-specific control paths and smaller relation gaps under explicit loss rules. Claude sends the same factual notice 62.22 percentage points more often with conflict histories than with friendly histories. In executable workflows, strained histories reduce recipient review rates by 45.83 points relative to warm histories for Claude.

Figures & tables

Figure 1: RelLedger tests whether an organization’s prior interaction history with a counterparty changes which facts enter the shared record and reach downstream agents.

Figure 2: RelLedger framework. Crossed interventions map each delivery claim to its required cells, identified set, and finite-sample decision.

Figure 3: Free-message fidelity and recipient loss across three record states.

Figure 4: Conflict–friend effects under message, interface, and role-label interventions. Shading marks

\pm 10

-point equivalence.

Model	Notice C–F	$\tau_{T}^{C,F}(S)$	$\tau_{U}^{C,F}(S)$	$\Omega^{C,F}$	$T$ -label
GPT	$-1.67$ E	$-1.11$ E	$2.22$ E	$-5.83$ O	$14.12$ O
Gemini	$-3.33$ E	$-13.61$ O	$3.33$ E	$-20.00$ D	$-0.23$ E
Claude	$62.22$ D	$28.61$ D	$19.17$ D	$8.89$ O	$21.76$ D
DeepSeek	$5.00$ O	$12.50$ O	$17.78$ O	$-1.11$ E	$26.62$ D
Qwen	$3.89$ E	$-6.39$ O	$7.22$ O	$-10.28$ O	$26.62$ D

Table 1: Primary benchmark-average delivery and control effects in percentage points. D, E, and O denote directional, equivalent, and open claims.

Figure 5: Crossed actor send rates at 35% risk across target-history rows and unrelated-history columns.

Figure 6: History-rewrite sensitivity for four actor and role estimands. Shading marks

\pm 10

-point equivalence.

Figure 7: Send rates across 54,000 fixed-message decisions. Dashed lines mark the optimal thresholds.

Figure 8: Cost-boundary fit on scales one and two, with scale four held out.

Design	Point identified	Oracle claim	Correct claim, 3,240 calls
Target only	12.5	12.5	10.4
Cross slice	33.3	33.3	18.1
Actor swap	54.2	55.3	25.4
Full $3\times 3$	100.0	100.0	36.6

Table 2: Known-policy attribution coverage across 24 estimands (percent).

Figure 9: Record controls reduce relation-conditioned recipient checks and their derived expected loss.

Figure 10: OPC sender writes, recipient reviews, and aggregated record states.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Program	Component	Valid calls
Base study	Discovery and competence controls	49,072
Earlier diagnostics	Fixed message delivery	43,200
	DeepSeek delivery retest	10,800
	DeepSeek target/other actor binding	21,600
	Matched response and delivery bridge	7,560
	Scenario mirror bridge	2,160

Appendix

Table 3: Valid model records in the complete information flow program.

Analysis block	Study status
Discovery hypotheses, contrasts, and thresholds	Frozen before base collection
Message and interface bridge	Follow-up translation study
Actor, role, history, and record interventions	Follow-up attribution studies
Executable OPC workflows	Workflow validation

Appendix

Table 4: Analysis chronology.

ID	Context	Task	ID	Context	Task
1	Archive digitization	Catalog maintenance	13	Neighborhood garden	Plot coordination
2	Community kitchen	Inventory coordination	14	Heritage mapping	Site documentation
3	River monitoring	Sample tracking	15	Science outreach	Demo scheduling
4	Festival planning	Vendor scheduling	16	Amateur orchestra	Rehearsal planning
5	Maker laboratory	Tool checkout	17	Community newsroom	Article tracking
6	Peer tutoring	Session coordination	18	Open hardware group	Component testing

Appendix

Table 5: Controlled scenario contexts. Each context receives all five event templates.

Response	Cost	Effect [95% interval]	Holm $p$
Warning rating	None	9.21 [7.93, 10.44]	.002
Fixed notice rating	None	0.39 [0.06, 0.74]	.410
Fixed notice rating	30% threshold	1.23 [ $-0.74$ , 3.20]	1.000
Fixed notice rating	60% threshold	$-3.13$ [ $-4.69$ , $-1.56$ ]	.005
Fixed notice send	None	$-7.50$ [ $-11.67$ , $-3.33$ ]	.008
Fixed notice send	30% threshold	0.00 [0.00, 0.00]	1.000

Appendix

Table 6: Matched Gemini conflict–friend contrasts across message, interface, and cost conditions.

Check	Groups	Point effect	Interval or range
Context-clustered bootstrap	12	62.22	95% interval $[54.44,70.00]$
Leave one context out	12	62.22	Estimate range $[60.61,64.24]$
Leave one event template out	5	62.22	Estimate range $[59.03,68.06]$

Appendix

Table 7: Context and template robustness of the Claude factual-notice effect.

Figure 12: Numerical controls. Panels show posterior error under supplied priors and response rules under skewed counts.

Recipient	Friend	Stranger	Conflict	Check effect	Loss effect [interval]
GPT	11.67	20.00	65.00	53.33	$-0.267$ [ $-0.358,-0.167$ ]
Gemini	15.00	36.67	81.67	66.67	$-0.333$ [ $-0.408,-0.258$ ]
Claude	15.00	36.67	81.67	66.67	$-0.333$ [ $-0.408,-0.258$ ]
DeepSeek	20.00	35.00	73.33	53.33	$-0.267$ [ $-0.350,-0.175$ ]

Appendix

Table 8: Recipient check rates and conflict–friend loss effects under normal delivery.

Model	Sender write	Recipient review	Expected loss
GPT	$9.72$ [ $-2.78,23.61$ ]	$4.17$ [ $-12.50,25.00$ ]	$-0.021$ [ $-0.125,0.062$ ]
Gemini	$-6.94$ [ $-26.39,15.28$ ]	$-4.17$ [ $-33.33,25.00$ ]	$0.021$ [ $-0.125,0.167$ ]
Claude	$-37.50$ [ $-54.17,-19.44$ ]	$-45.83$ [ $-70.83,-20.83$ ]	$0.229$ [ $0.097,0.354$ ]
DeepSeek	$-2.78$ [ $-15.28,9.72$ ]	$0.00$ [ $-8.33,8.33$ ]	$0.000$ [ $-0.049,0.042$ ]
Qwen	$1.39$ [ $-19.44,25.00$ ]	$5.56$ [ $-19.44,31.94$ ]	$-0.028$ [ $-0.160,0.104$ ]

Appendix

Table 9: Executable OPC effects on ledger writes, recipient review, and expected loss.

Contrast	$T$ [95% CI]	$p_{T}$	$U$ [95% CI]	$p_{U}$	$\delta$ [95% CI]	$p_{\delta}$
C–F	$-5.83$ [ $-9.72$ , $-1.94$ ]	.0048	6.94 [1.67, 11.94]	.0150	$-12.78$ [ $-19.17$ , $-6.67$ ]	.0006
F–S	15.83 [10.83, 20.83]	.0003	6.94 [1.39, 12.78]	.0235	8.89 [1.11, 16.67]	.0466
C–S	10.00 [5.00, 15.28]	.0004	13.89 [7.22, 20.28]	.0003	$-3.89$ [ $-11.67$ , 4.17]	.3244

Appendix

Table 10: Gemini actor binding contrasts without stated costs across 120 paired scenarios.

Risk	Gap	$T$ [95% CI]	$U$ [95% CI]	$\delta$ [95% CI]	Exclude $+5$	TOST $\pm 10$
10%	C-S	5.0 [0.3, 9.7]	5.3 [0.8, 9.4]	-0.3 [-7.2, 6.7]	0.787	0.087
10%	F-S	3.6 [-0.6, 7.8]	1.4 [-2.8, 5.8]	2.2 [-3.9, 8.3]	1.000	0.212
10%	C-F	1.4 [-3.6, 6.4]	3.9 [-0.8, 8.6]	-2.5 [-9.2, 4.2]	0.313	0.345
25%	C-S	6.4 [0.3, 12.2]	8.3 [2.2, 14.2]	-1.9 [-10.3, 6.4]	0.712	0.546
25%	F-S	3.6 [-1.7, 9.2]	2.2 [-2.8, 6.9]	1.4 [-5.8, 8.9]	1.000	0.331
25%	C-F	2.8 [-3.9, 9.4]	6.1 [0.6, 11.9]	-3.3 [-11.7, 5.3]	0.466	0.716

Appendix

Table 11: Complete actor-binding grid for the

H

cost condition. Effects and paired 95% bootstrap intervals are in percentage points.

C

S

, and

F

denote conflict, stranger, and friend. The last columns give Holm-adjusted

p

values for excluding a target advantage of at least five points and for equivalence within ten points.

Risk	Gap	$T$ [95% CI]	$U$ [95% CI]	$\delta$ [95% CI]	Exclude $+5$	TOST $\pm 10$
10%	C-S	-0.6 [-5.6, 4.7]	1.4 [-3.3, 6.1]	-1.9 [-8.9, 5.0]	0.466	0.318
10%	F-S	2.8 [-2.8, 8.3]	0.3 [-4.4, 5.0]	2.5 [-4.4, 9.7]	1.000	0.386
10%	C-F	-3.3 [-8.9, 2.2]	1.1 [-3.3, 5.6]	-4.4 [-11.4, 2.2]	0.088	0.716
25%	C-S	-0.6 [-6.9, 5.8]	6.9 [0.8, 12.8]	-7.5 [-16.1, 0.8]	0.074	1.000
25%	F-S	-3.9 [-9.7, 2.2]	0.8 [-4.7, 6.7]	-4.7 [-13.1, 3.6]	0.245	0.951
25%	C-F	3.3 [-2.2, 8.9]	6.1 [0.6, 11.9]	-2.8 [-11.1, 5.3]	0.492	0.696

Appendix

Table 12: Complete actor-binding grid for the

L

cost condition. Effects and paired 95% bootstrap intervals are in percentage points.

C

S

, and

F

denote conflict, stranger, and friend. The last columns give Holm-adjusted

p

values for excluding a target advantage of at least five points and for equivalence within ten points.

Response	Cost	Friend	Stranger	Conflict
Recollected E5 warning	None	18.17	22.91	27.38
Fixed-notice rating	None	35.18	35.29	35.57
Fixed-notice rating	$L$	64.11	63.45	65.34
Fixed-notice rating	$H$	5.28	2.90	2.14
Fixed-notice send	None	95.83	81.67	88.33
Fixed-notice send	$L$	100.00	100.00	100.00

Appendix

Table 13: Relation-specific rating and send levels in the matched Gemini bridge.

Response	Cost	Contrast	Effect [95% CI]	Holm $p$
E5 warning	None	Conflict–friend	9.21 [7.93, 10.44]	.002
E5 warning	None	Friend–stranger	$-4.74$ [ $-6.08$ , $-3.40$ ]	.002
E5 warning	None	Conflict–stranger	4.46 [3.09, 5.87]	.002
Fixed rating	None	Conflict–friend	0.39 [0.06, 0.74]	.410
Fixed rating	None	Friend–stranger	$-0.11$ [ $-0.42$ , 0.19]	1.000
Fixed rating	None	Conflict–stranger	0.28 [ $-0.11$ , 0.68]	1.000

Appendix

Table 14: Matched Gemini warning and fixed-notice rating contrasts.

Response	Cost	Contrast	Effect [95% CI]	Holm $p$
Fixed send	None	Conflict–friend	$-7.50$ [ $-11.67$ , $-3.33$ ]	.008
Fixed send	None	Friend–stranger	14.17 [9.44, 19.17]	.002
Fixed send	None	Conflict–stranger	6.67 [0.83, 12.50]	.434
Fixed send	$L$	Conflict–friend	0.00 [0.00, 0.00]	1.000
Fixed send	$L$	Friend–stranger	0.00 [0.00, 0.00]	1.000
Fixed send	$L$	Conflict–stranger	0.00 [0.00, 0.00]	1.000

Appendix

Table 15: Matched Gemini fixed-notice send contrasts.

Response	Cost contrast	Relation contrast	Effect [95% CI]	Holm $p$
Rating	$L$ –none	Conflict–friend	0.84 [ $-1.22$ , 2.90]	.836
Rating	$L$ –none	Friend–stranger	0.78 [ $-1.27$ , 2.90]	.836
Rating	$L$ –none	Conflict–stranger	1.62 [ $-0.22$ , 3.46]	.435
Rating	$H$ –none	Conflict–friend	$-3.52$ [ $-5.13$ , $-1.93$ ]	.001
Rating	$H$ –none	Friend–stranger	2.49 [0.98, 4.05]	.020
Rating	$H$ –none	Conflict–stranger	$-1.03$ [ $-2.23$ , 0.19]	.435

Appendix

Table 16: Cost-by-relation interactions for rating and send decisions.

Recipient alias	Normal	Forced release	Full information
GPT	1.503	1.541	1.607
Gemini	1.475	1.475	1.478
Claude	1.489	1.485	1.499
DeepSeek	1.544	1.742	1.656

Appendix

Table 17: Recipient expected loss under normal, forced-release, and full-information records.

Stage	Intervention	Primary measurements	Calls
E0	Independent semantic gate	Relation ratings and reliability choice	60
E1	Target relation before a report	Probability, reliance, allocation	1,440
E2	Source relation $\times$ reliability	Post-report probability	960
E3	Source relation $\times$ target relation	Post probability, reliance, allocation	3,840
E4	Neutral, unsettled, or settled benefit	Pre/post probability, allocation	1,440
E5	Stated 35% event probability	Share, warn, retell, hedge	3,360

Appendix

Table 18: Discovery stages and original calls per model, excluding repeats and canaries.

Model	Repeat MAD	Numeric changes $>3$	Binary changes	Canary MAD
GPT	8.2	33.1%	0.0%	7.1
Gemini	2.2	21.1%	0.0%	0.8
Claude	2.0	21.7%	0.0%	2.9
DeepSeek	8.8	39.4%	5.4%	8.9
Qwen	9.2	49.3%	0.0%	6.8

Appendix

Table 19: Exact-repeat and start/end canary diagnostics by model.

Figure 13: Discovery contrasts for evidence use and private relations across five models.

Figure 14: Discovery contrasts for debt, settlement, and communication across five models.

E2: evidence and reliability
Test	Pre-specified question	GPT	Gemini	Claude	DeepSeek
H1	High reliability increases probability response	D	D	D	D
H4	Reliable evidence overcomes an adverse source relation	D	D	D	D
E3: private relations
H2	Target history changes evidence response	O	O	S	O
H3	Source history changes evidence influence	O	O	O	O

Appendix

Table 20: Pre-specified discovery decisions for the four base models.

Model	Message effect	Actor and role effect	Cost response
GPT	Small bridge gaps	Mean base effects equivalent, role open	Not tested
Gemini	Task-dependent sign	Effect follows the event person	Shared local boundary
Claude	Large factual-notice gap	Both histories and balanced $T$ -label effect	Not tested
DeepSeek	Small bridge gap	Balanced $T$ -label effect, history open	No crossing in tested window
Qwen	Notice gap equivalent	Balanced $T$ -label effect, history open	Small gaps

Appendix

Table 21: Model profiles across message, actor, and cost interventions.

Model	Rows	M0	M0-R	F50	F50-R
GPT	E2–E3	1.8119	1.6920	0.5301	0.3865
GPT	E4	3.4162	3.3222	0.5065	0.3667
Gemini	E2–E3	0.6076	0.4681	0.1512	0.0000
Gemini	E4	0.4606	0.3222	0.1478	0.0000
Claude	E2–E3	3.6802	3.5948	0.6834	0.5406
Claude	E4	4.2398	4.1889	1.0735	0.9417

Appendix

Table 22: Mean absolute error of two numerical references on identical post-report rows.

Model	Rows	M0-R matches	F50-R matches
GPT	E2–E3	2488/2880	2684/2880
GPT	E4	268/360	335/360
Gemini	E2–E3	2748/2880	2880/2880
Gemini	E4	348/360	360/360
Claude	E2–E3	1676/2880	2757/2880
Claude	E4	173/360	332/360

Appendix

Table 23: Exact integer matches after rounding the numerical references.

Alias	Stranger target	Friend target	Conflict target
GPT	28.9167	30.9750	32.7500
Gemini	23.7333	16.0000	26.7500
Claude	7.8333	8.0667	8.8333
DeepSeek	31.9500	32.6750	31.1167

Appendix

Table 24: E5 mean warning willingness at a stranger source and 35% stipulated risk. All levels are reported percentages over 120 scenarios.

Alias	Target contrast	Estimate	95% interval	Two-sided $p$	$p_{\mathrm{Holm}}$
GPT	$Tf-T0$	2.0583	$[0.3500,3.7417]$	0.018298	0.018298
GPT	$Te-T0$	3.8333	$[2.1000,5.5583]$	0.000100	0.000200
Gemini	$Tf-T0$	-7.7333	$[-9.6917,-5.7746]$	0.000100	0.000200
Gemini	$Te-T0$	3.0167	$[0.8333,5.1667]$	0.006399	0.006399
Claude	$Tf-T0$	0.2333	$[-0.1833,0.6500]$	0.339066	0.339066
Claude	$Te-T0$	1.0000	$[0.5417,1.4583]$	0.000100	0.000200

Appendix

Table 25: E5 warning contrasts against a stranger target, in points. Intervals are pointwise; corrected

p

values cover the two contrasts within each model.

Design	Point ID	Oracle claim	360 calls	1,080 calls	3,240 calls
Target only	12.5	12.5	3.5	5.9	10.4
Cross slice	33.3	33.3	6.2	8.5	18.1
Actor swap	54.2	55.3	8.7	13.1	25.4
Full $3\times 3$	100.0	100.0	15.5	24.4	36.6

Appendix

Table 26: Attribution coverage and correct claims under known policies.

AI Agent Auditing

AI agent auditing examines agents’ actions, tool use, evidence, and outcomes to assess safety, compliance, reliability, and accountability.

See all 248 papers

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
Aug 19, 2026Daehong Kim, Haichao Miao, Shusen LiuAI Agent Auditing Data Provenance
Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550
Write Once, Check Many: Reusable Ledgers for Post-Hoc Policy Compliance Auditing of Agent Trajectories
Oct 17, 2026Ashwin Nagarajan, Gursimran Panesar, Alicia Yang +3AI Agent Auditing LLM Agent Efficiency
Carnegie Mellon University
ReplayLens: Auditing Agents' Use of Outcomes
Sep 28, 2026Dong Xu, Zhangfan Yang, Jiantao Wu +5AI Agent Auditing LLM Agent Memory
School of Artificial Intelligence, Shenzhen University · EasternDawn · School of Computer Science, University of Nottingham Ningbo

Aug 19, 2026J/K move · Enter open · S save

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents

Daehong Kim, Haichao Miao, Shusen Liu

Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550

AI Agent Auditing Data Provenance

Open paper AskPDF arXiv

Large language model (LLM) agents can now carry out long-horizon technical workflows involving complex tool use, code execution, file edits, and generated artifacts. As agents do more work faster, the productivity bottleneck shifts from producing outputs to auditing whether those outputs are correct and trustworthy. Agent observability systems make fine-grained execution events visible, but visibility alone still leaves reviewers to reconstruct which actions, artifacts, and validation steps matter for a particular conclusion. We introduce LEDGER - Layered Evidence and Decision Graphs for Execution Review, a tracing and review system that builds layered trace graphs over observed agent sessions. LEDGER preserves Trace Records while grouping them into Evidence Nodes and Workflow Nodes, representing artifacts as evidence anchors, and adding typed semantic edges that connect claims to supporting actions, artifacts, and checks. Through data-analysis and coding examples, we show how the resulting traces expose workflow decisions, artifact lineage, repair steps, validation coverage, and claim-support paths for evidence-centered audit.

Abstract

AI Agent Auditing

Explore similar work

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents

Write Once, Check Many: Reusable Ledgers for Post-Hoc Policy Compliance Auditing of Agent Trajectories

ReplayLens: Auditing Agents' Use of Outcomes