Model clarifies evidence claims and trust in agentic AI systems
An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment
Cryptography and Security
Summary
Agentic AI systems often make decisions, exchange messages, and update shared work in complex ways. The authors point out that logs and cryptographic anchors, while helpful, can sometimes mislead if their meaning is not clear. They propose a detailed model that breaks down different kinds of evidence and trust claims about these systems. The model helps clarify what kinds of trust or proof such AI systems can really provide, and what assumptions or limits exist. This creates a common language to discuss the reliability and governance of agentic AI processes.
What this means in practice
- •For ai system architects: Define and communicate which trust claims an AI-driven process can support and what controls are needed around it.
- •For compliance teams: Design internal policies that align with clear evidence claims to better assess and manage agentic AI risks.
A position paper. It proposes an approach and reports no results.
Authors
Arslan Brömme
Abstract
Agentic AI systems increasingly exchange messages, invoke tools, request approvals, hold structured decision sessions, and modify shared artifacts. Logs and anchors can make selected records tamper-evident, but they can also mislead if their evidentiary meaning is implicit: a hash does not establish semantic truth, a signature does not establish authorization, and an external anchor does not establish capture completeness. This paper proposes an evidence claim model for agentic processes. It distinguishes artifact integrity, temporal existence, provenance, approval evidence, declared ordering, capture claim, relevance claim, deliberation traceability, monitoring claim, anchoring authorization claim, policy assessment claim, risk treatment claim, mitigation implementation claim, and management response claim. Semantic validity is treated as a recurring limitation. The model maps these claims to mechanisms, assumptions, limitations, and threats, and situates them in an agent organization with functional CEO agent, executive, operational, evidence, and audit roles, plus a plan-do-check-act-inspired management response loop. The contribution is conceptual: it does not validate a particular implementation, prevent all failures, or automate legal compliance. It provides a vocabulary for stating which claims an agentic black box can support, which claims it cannot establish, and which controls are required around it.