Agentic process evidence
Organizations: JFrog
Abstract
The way software gets built is changing dramatically. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral - their reasoning, decisions, and tool calls vanish the moment the session ends. Modern Security incidents involving intent mismatch or injection are becoming increasingly common - forcing us to address AI Agents as an insider threat. No widely adopted standard yet enables agentic provenance and governance and its obvious that you can't hold an ephemeral process accountable. The git log was designed for human commits. It shows what changed. It does not show what an AI agent did, which model it used, which tools it called, or whether anyone was accountable for the outcome. Every governance framework, every audit trail, every compliance control in the SDLC was built around one assumption: a human made the decision. That assumption no longer holds. This shift introduces 3 main procedural problems (not addressing scale) - Supply-chain vector - The agentic coder is software, so it is a supply-chain security risk. Policy guardrails - How to ensure the agentic coder is compliant with the policies of the organization. Task-alignment - How to align the agentic coder on its tasks and goals. We introduce Agentic Process Evidence (APE), a signed, tamper-evident, machine-readable attestation of agentic processes, linking the sessions to their outcome (process-aware logging). APE enables Policy-as-Code control over the agentic processes, allowing for human in the loop only when it's needed. We support the in-toto style attestation framework, and the protocol is aligned with the relevant regulations
Figures & tables
| Field | Mandatory | Explanation | Example |
|---|---|---|---|
| sessionId | yes | Identifier of this session. Process evidence cites the log by it. | a1b2c3d4-… |
| parentSessionId | no | Parent session, when this run was started by another. | 4o7g54cd-… |
| affectedEntities | no | Entities the session produced or handled, such as a commit. | gitCommit bf02510… |
| provider | yes | Harness, agent, and language models for this log. | — |
| provider.harness.name | yes | Harness product name. | cursor |
| provider.harness.version | yes | Harness version as the producer reports it. | 3.5.33 |
| Event | Explanation | Example |
|---|---|---|
| beforeSubmitPrompt | The prompt submitted to the agent. | Rate-limit POST /api/orders . |
| agentThought | The chain of thought. | Check the guidelines, then add a token bucket. |
| preToolUse | A tool or MCP call, including its arguments. The matching postToolUse carries the result. | Write on src/orders/rate_limit.py |
| afterAgentResponse | The agent’s reply. | Added a token bucket on POST /api/orders . |
| Field | Mandatory | Explanation | Example |
| _type | yes | Evidence schema. The in-toto Statement v1 URI. | https://in-toto.io/Statement/v1 |
| subject | yes | The outcome. Each entry has uri and digest . | — |
| subject[].uri | yes | Where the outcome can be fetched. | https://github.com/MYORG/orders/commit/bf02510 |
| subject[].digest | yes | Digest of the outcome. At least one algorithm. | gitCommit bf02510… |
| predicateType | yes | URI of this evidence kind. The deployment pins one. | https://jfrog.com/evidence/agentic-process/v0.1 |
| createdAt | yes | When the evidence was created. | 2026-04-08T09:11:02Z |
| Field | Human-in-the-loop | Autonomous | Code review | Customer success |
|---|---|---|---|---|
| subject | commit bf02510 | commit bf02510 | commit bf02510 | the session log |
| traceId | — | cloud factory trace identifier | provider trace identifier | support system trace identifier |
| processType | code-development | code-development | code-review | support-process |
| reviewers | [email protected] | — | — | — |
| owner | [email protected] | [email protected] | [email protected] | [email protected] |
| sessionsLogs | one or more | one or more | one | one |
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
| Field | Mandatory | Explanation | Example |
|---|---|---|---|
| processType | yes | Type of agentic process. | code-development |
| providers | yes | Harness, agent, and model for the commit. | Cursor 3.5.33, cursor-agent 1.0, Claude Opus 4.8 |
| traceId | no | Process identifier, shared by the sessions before the commit exists. | feature/fin-3678-… |
| sessionsLogs | yes | One or more logs for this commit. Each entry needs uri and digest . | Three logs: a1b2c3d4 , b7c1e2a0 , c8d2f3b1 |
| tools | no | Tools the sessions called. A listed tool needs name . | Read, Write, mcp:orders/list_routes |
| contextArtifacts | no | Policy and guideline injected into the sessions. | Development guidelines (policy), architecture guidelines (guideline) |
| Field | Mandatory | Explanation | Example |
|---|---|---|---|
| processType | yes | Type of agentic process. | code-development |
| providers | yes | Harness, agent, and model for the commit. | Cursor 3.5.33, cursor-agent 1.0, Claude Opus 4.8 |
| traceId | no | Process identifier. | feature/fin-3678-… |
| sessionsLogs | yes | One or more logs for this commit. | One log, a1b2c3d4 |
| tools | no | Tools the session called. | Read, Write |
| contextArtifacts | no | Policy and guideline injected into the session. | Development guidelines (policy), architecture guidelines (guideline) |
| Field | Mandatory | Explanation | Example |
|---|---|---|---|
| processType | yes | Type of agentic process. | code-review |
| providers | yes | Harness, agent, and model of the reviewer. | GitHub Actions 2.322.0, code-review-agent 0.9.0, Claude Sonnet 4 |
| traceId | no | This review run. Full value in the appendix. | b2c3d4e5… |
| sessionsLogs | yes | The one log of this review. | One log, b2c3d4e5 |
| tools | no | Tools the review called. | Read, GitDiff |
| contextArtifacts | no | Rubric the review was given. | org-review-rubric.md (policy) |
| Field | Mandatory | Explanation | Example |
|---|---|---|---|
| processType | yes | Type of agentic process. | support-process |
| providers | yes | Harness, agent, and model that handled the case. | support-desk 4.2.0, support-agent 2.1.0, GPT-4.1 |
| traceId | no | This session, which is also the process. Full value in the appendix. | c9e8d7f6… |
| sessionsLogs | no | One session. May be omitted when the log holds a third-party product secret. The subject may already be that log. | omitted |
| tools | no | Tools the session called. | Read, OrderLookup |
| contextArtifacts | no | Policy the session was given. | support-refund-policy.md (policy) |
AI Agent Governance
AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.
See all 446 papers