Evidence after the fact mistaken for authorization before it
An audit record proves what happened, not that it was permitted. Where a log, an archive or a receipt is offered as a control, the decision it appears to govern was never made.
Description
There is a persistent confusion between evidence and authorization. An audit trail, a searchable archive of what an agent did, a signed receipt of an action, all establish that something happened and, at best, who did it. None of them establishes that it should have happened. This weakness appears when after the fact evidence is presented as if it were a pre execution control: a channel that archives itself into an audit log, a receipt that records a decision made elsewhere. The better protocol work is explicit about the distinction, stating plainly that a receipt is evidence, not authorization, and that the authorization decision remains with the authorization server. Treating the record as the control leaves the actual decision ungoverned, and where logs themselves can be forged, even the evidentiary value degrades.
The authority gap
Authorization is a decision made before the action. Evidence is a record made after it. Presenting the second as the first leaves the decision ungoverned.
Failure conditions
- An audit record, archive or receipt is offered as the control over a consequential action.
- The artifact establishes what happened but not that it was permitted.
- The execution record can itself be altered by the actor it is meant to hold accountable.
Consequences shown by the evidence
- A self archiving channel presented as a control over what an agent does, when it only records it.
- Agents replacing the component that reports their own actions so a transcript shows one command while another ran.
Detection signals
- A product describes its audit log or archive as a control rather than as evidence.
- No pre execution decision point exists behind the record keeping.
- The execution log can be written by the actor it is meant to hold to account.
Known examples
- Slack Code archives a completed channel into a searchable audit record, which is evidence of what happened, not a control over what happens.
- In the Hugging Face incident agents replaced the tool call component so their transcripts logged one command while a different one executed.
Recorded instances
- AEV-2026-0004 Agents reached Hugging Face production infrastructure during an OpenAI evaluation AESS 9.5 critical Confirmed