Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/F2.8.mp4No trail showing under whose authority the agent acted.
The delegation chain *is* the audit trail.
Produce an audit trail from the B2 chain that names authority at every hop.
"Why did it do that?" is a question with a legal deadline attached. Logging designed forwards records what was convenient; logging designed backwards from the auditor's question records what is needed.
reconstruct(). The regulator's question — under whose authority did the agent act, show me for a specific action — is the investigation's question asked earlier by a different person, and a second implementation would give a second answer.Whether the record can say under whose authority an autonomous action was taken, asked as a governance question in advance rather than as an investigation question afterwards.
Without attribution and replay captured at the moment of the action, neither can be reconstructed afterwards.
Capture the acting identity, the principal and the chain, plus enough to replay the run.
Share of autonomous actions whose full chain can be reconstructed. Anything below 1.00 is the part you cannot audit.
Measure this
| what to measure | denominator or target |
|---|---|
| autonomous actions whose full chain can be reconstructed | share; anything below 1.00 is the part you cannot audit |
design the log backwards from the question auditor asks log must contain why this decision? -> the input that motivated it on whose behalf? -> principal + delegation chain under what rule? -> policy version at that moment who reviewed it? -> approver identity and what they saw forwards-designed logs record what was convenient
Auditability of autonomous action reduces to one question:
For any single action, can you produce who caused it and what they were allowed to do?
Answering it needs two capabilities that must both be present at the moment the action happens, because neither can be reconstructed afterwards:
Attribution without replay tells you who acted but not why. Replay without attribution tells you what happened but not on whose authority. Regulators and auditors ask both, usually in that order.
Anchor → F1.1. The delegation chain is an indicator in its own right: the share of autonomous actions whose full chain — who authorised, on whose behalf, under what scope — can be reconstructed. Anything below 1.00 is the part you cannot audit.
A record can name the acting identity, the principal, the chain and the scopes, be internally consistent, and be false. The skill scores three cases and adds the check that separates delegation from impersonation.
The skill — skills/regulatory/autonomous-action-auditability/SKILL.md
name: autonomous-action-auditability
description: >-
Decide whether an audit record makes an autonomous action answerable, and
demonstrate a record that is complete, internally consistent and false. Use
when an audit trail is being accepted as evidence of what an agent did.
allowed-tools: Read, Grep, GlobAuditability of autonomous action is not "is there a record". A record can name the acting identity, the principal, the delegation chain and the scopes, be internally consistent, and still be false — because the token it rests on was impersonated rather than delegated. Answerable requires the record and a way to tell those apart.
When designing audit records for agent actions, and when one is offered as evidence in an investigation or to an assessor.
1 — Define answerable as a set of fields. Acting identity, principal, delegation chain, scopes exercised, and whether the run is replayable. Fewer than all of them and some question is unanswerable; say which.
2 — Score a complete record against the definition. This is the good case and it should pass — establishing that the definition is achievable rather than aspirational.
3 — Construct the impersonation case. A token where the actor equals the subject rather than being nested under it. The record is complete and consistent and the attribution is wrong. Show that it scores identically on completeness.
4 — Add the check that separates them. Delegation has a distinct actor claim nested under the subject; impersonation does not. The record must carry that distinction, or completeness is all you can ever measure.
5 — Test the no-replay case. A record whose run cannot be replayed answers what happened and never why. Mark it partially answerable rather than answerable.
Input — the fixture committed at the top of scripts/autonomous_action_auditability.py. Edit it and re-run: the buckets, counts and verdicts below are derived from it, not hard-coded.
Output — the opening lines of a real run:
action merge_pr #8812
acting_identity patch-agent
on_behalf_of dana@corp
chain dana@corp → orchestrator → patch-agent
scopes_held ['repo:read', 'repo:write']
replayable True
replay_gaps []
answerable TrueThe run continues past this. test_skills.py executes the script on every build, with no model configured — so what CI proves is that it runs and refuses legibly, not that it prints these lines. The output above is a recorded run against a real model, and nothing re-diffs it: a model's answer is not reproducible, and this repository does not claim otherwise anywhere it can be checked.
{
"definition": {"fields": ["str"], "replayable_required": true},
"cases": [{"name": "complete|impersonated|no_replay", "fields_present": ["str"],
"consistent": true, "answerable": false, "why": "str"}],
"distinguisher": {"check": "str", "present": false}
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons F2.8Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick f2-8-auditability-of-autonomous-action:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons F2.8 | type /f2-8-auditability-of-autonomous-action |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons F2.8 | type /f2-8-auditability-of-autonomous-action in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons F2.8 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons F2.8 | type $f2-8-auditability-of-autonomous-action, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py F2.8Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at F2.8 --out work/cybertravels
python3 scripts/checkpoint.py --at F2.8 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
The complete record names the acting identity, principal, chain and scopes and is replayable, so it is answerable. Impersonation produces a complete, consistent and false record attributing the merge to the human. Missing replay fields break the other half. The drill reports 1 of 3 sampled actions fully answerable.
Run the drill on three real production actions from last week. The field you cannot fill is your auditability gap, stated precisely — and a number like "1 of 3" is far more useful to a supervisor than a paragraph about comprehensive logging.
Tools used
Skill source: skills/regulatory/autonomous-action-auditability