Agentic process evidence

Yuval Kainan; Carmit Hershman

cs.AIOct 29, 2026

Agentic process evidence

Authors: Yuval Kainan, Carmit Hershman

Organizations: JFrog

Abstract

The way software gets built is changing dramatically. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral - their reasoning, decisions, and tool calls vanish the moment the session ends. Modern Security incidents involving intent mismatch or injection are becoming increasingly common - forcing us to address AI Agents as an insider threat. No widely adopted standard yet enables agentic provenance and governance and its obvious that you can't hold an ephemeral process accountable. The git log was designed for human commits. It shows what changed. It does not show what an AI agent did, which model it used, which tools it called, or whether anyone was accountable for the outcome. Every governance framework, every audit trail, every compliance control in the SDLC was built around one assumption: a human made the decision. That assumption no longer holds. This shift introduces 3 main procedural problems (not addressing scale) - Supply-chain vector - The agentic coder is software, so it is a supply-chain security risk. Policy guardrails - How to ensure the agentic coder is compliant with the policies of the organization. Task-alignment - How to align the agentic coder on its tasks and goals. We introduce Agentic Process Evidence (APE), a signed, tamper-evident, machine-readable attestation of agentic processes, linking the sessions to their outcome (process-aware logging). APE enables Policy-as-Code control over the agentic processes, allowing for human in the loop only when it's needed. We support the in-toto style attestation framework, and the protocol is aligned with the relevant regulations

Figures & tables

Field	Mandatory	Explanation	Example
sessionId	yes	Identifier of this session. Process evidence cites the log by it.	a1b2c3d4-…
parentSessionId	no	Parent session, when this run was started by another.	4o7g54cd-…
affectedEntities	no	Entities the session produced or handled, such as a commit.	gitCommit bf02510…
provider	yes	Harness, agent, and language models for this log.	—
provider.harness.name	yes	Harness product name.	cursor
provider.harness.version	yes	Harness version as the producer reports it.	3.5.33

Table 1: Fields of an agentic session log. Examples are from the human-in-the-loop log.

Event	Explanation	Example
beforeSubmitPrompt	The prompt submitted to the agent.	Rate-limit POST /api/orders .
agentThought	The chain of thought.	Check the guidelines, then add a token bucket.
preToolUse	A tool or MCP call, including its arguments. The matching postToolUse carries the result.	Write on src/orders/rate_limit.py
afterAgentResponse	The agent’s reply.	Added a token bucket on POST /api/orders .

Table 2: Some events a session log records. This list is not exhaustive.

Field	Mandatory	Explanation	Example
_type	yes	Evidence schema. The in-toto Statement v1 URI.	https://in-toto.io/Statement/v1
subject	yes	The outcome. Each entry has uri and digest .	—
subject[].uri	yes	Where the outcome can be fetched.	https://github.com/MYORG/orders/commit/bf02510
subject[].digest	yes	Digest of the outcome. At least one algorithm.	gitCommit bf02510…
predicateType	yes	URI of this evidence kind. The deployment pins one.	https://jfrog.com/evidence/agentic-process/v0.1
createdAt	yes	When the evidence was created.	2026-04-08T09:11:02Z

Table 3: Fields of an agentic process-evidence statement. Examples are from the human-in-the-loop commit.

Field	Human-in-the-loop	Autonomous	Code review	Customer success
subject	commit bf02510	commit bf02510	commit bf02510	the session log
traceId	—	cloud factory trace identifier	provider trace identifier	support system trace identifier
processType	code-development	code-development	code-review	support-process
reviewers	[email protected]	—	—	—
owner	[email protected]	[email protected]	[email protected]	[email protected]
sessionsLogs	one or more	one or more	one	one

Table 4: Evidence implementation comparison. — means the field is absent.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Field	Mandatory	Explanation	Example
processType	yes	Type of agentic process.	code-development
providers	yes	Harness, agent, and model for the commit.	Cursor 3.5.33, cursor-agent 1.0, Claude Opus 4.8
traceId	no	Process identifier, shared by the sessions before the commit exists.	feature/fin-3678-…
sessionsLogs	yes	One or more logs for this commit. Each entry needs uri and digest .	Three logs: a1b2c3d4 , b7c1e2a0 , c8d2f3b1
tools	no	Tools the sessions called. A listed tool needs name .	Read, Write, mcp:orders/list_routes
contextArtifacts	no	Policy and guideline injected into the sessions.	Development guidelines (policy), architecture guidelines (guideline)

Appendix

Table 5: Predicate fields for human-in-the-loop development. Mandatory is for this profile. The example is Appendix C.1.2 .

Field	Mandatory	Explanation	Example
processType	yes	Type of agentic process.	code-development
providers	yes	Harness, agent, and model for the commit.	Cursor 3.5.33, cursor-agent 1.0, Claude Opus 4.8
traceId	no	Process identifier.	feature/fin-3678-…
sessionsLogs	yes	One or more logs for this commit.	One log, a1b2c3d4
tools	no	Tools the session called.	Read, Write
contextArtifacts	no	Policy and guideline injected into the session.	Development guidelines (policy), architecture guidelines (guideline)

Appendix

Table 6: Predicate fields for autonomous development. Mandatory is for this profile. The example is Appendix C.2.2 .

Field	Mandatory	Explanation	Example
processType	yes	Type of agentic process.	code-review
providers	yes	Harness, agent, and model of the reviewer.	GitHub Actions 2.322.0, code-review-agent 0.9.0, Claude Sonnet 4
traceId	no	This review run. Full value in the appendix.	b2c3d4e5…
sessionsLogs	yes	The one log of this review.	One log, b2c3d4e5
tools	no	Tools the review called.	Read, GitDiff
contextArtifacts	no	Rubric the review was given.	org-review-rubric.md (policy)

Appendix

Table 7: Predicate fields for code review. Mandatory is for this profile. The example is Appendix C.3.2 .

Field	Mandatory	Explanation	Example
processType	yes	Type of agentic process.	support-process
providers	yes	Harness, agent, and model that handled the case.	support-desk 4.2.0, support-agent 2.1.0, GPT-4.1
traceId	no	This session, which is also the process. Full value in the appendix.	c9e8d7f6…
sessionsLogs	no	One session. May be omitted when the log holds a third-party product secret. The subject may already be that log.	omitted
tools	no	Tools the session called.	Read, OrderLookup
contextArtifacts	no	Policy the session was given.	support-refund-policy.md (policy)

Appendix

Table 8: Predicate fields for customer success. Mandatory is for this profile. The example is Appendix C.4.2 .

AI Agent Governance

AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.

See all 446 papers

Responsible Agentic AI Requires Explicit Provenance
May 16, 2026Jinwei Hu, Xinmiao Huang, Qisong He +3Data Provenance Algorithmic Accountability
School of Computer Science and Informatics, University of Liverpool, UK · Department of Computer Science, Mohamed bin Zayed University of Artificial Intelligence, UAE
Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries
May 24, 2026Ylli PriftiSoftware Engineering Agents LLM Agent Orchestration
Birkbeck, University of London
Beyond the 'Diff': Addressing Agentic Entropy in Agentic Software Development
Mar 3, 2026Matteo Casserini, Alessandro Facchini, Andrea FerrarioAI Agent Monitoring Software Engineering Agents
Dipartimento Tecnologie Innovative, SUPSI, Switzerland · Dalle Molle Institute for Artificial Intelligence (IDSIA), SUPSI, Switzerland · Management in Networked and Digital Societies (MINDS) Department, Kozminski University, Poland +2

May 16, 2026J/K move · Enter open · S save

Responsible Agentic AI Requires Explicit Provenance

Jinwei Hu, Xinmiao Huang, Qisong He, Youcheng Sun+2

School of Computer Science and Informatics, University of Liverpool, UK · Department of Computer Science, Mohamed bin Zayed University of Artificial Intelligence, UAE

Data Provenance Algorithmic Accountability AI Agent Governance Responsible AI

Open paper AskPDF arXiv

Agentic AI is rapidly proliferating across diverse real-world domains such as software engineering, yet public trust has not kept pace. The central reason is that responsibility, despite being widely discussed, remains a subjective and unenforced concept, as no current agentic framework produces the quantifiable, traceable, and interventionable provenance needed to assign it when harm emerges from compositions no single party designed. We position that what is missing is not better benchmark-level evaluation but

\textbf{explicit provenance}

across the full agentic lifecycle, which is the only viable basis for making responsibility computable and actionable. We advance this agenda along four axes: establishing

\textit{why}

such provenance is a structural necessity by identifying responsibility gaps across sociotechnical dimensions, formalizing

\textit{what}

it must encode through a causal attribution function and responsibility tensor, discussing

\textit{how}

it can be made computable across four lifecycle layers with preliminary experiments showing that provenance is estimable and interveneable online before irreversible harm accumulates, and examining

\textit{who}

bears responsibility through a concrete agentic incident. Explicit provenance is not a discretionary refinement but the necessary condition for responsible agentic AI, and no stakeholder across its ecosystem can afford to treat it as optional.

Abstract

AI Agent Governance

Explore similar work

Responsible Agentic AI Requires Explicit Provenance

Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries

Beyond the 'Diff': Addressing Agentic Entropy in Agentic Software Development