Identity vendors have moved fast on agents. The largest ones no longer stop at credentials. They discover agents across SaaS platforms, grant just-in-time access, make authorization decisions at runtime, inspect prompts inline, and give security teams a kill switch.
This is real progress. It governs what an agent is allowed to do, and it stops an agent that tries something it should not.
It does not give you a record of what the agent actually did that anyone outside the operator can trust.
Where identity and authorization stop
Both were designed for a principal making a request. Agents break that model in five places.
Shared credentials collapse many actors into one. Much agent traffic still runs on static API keys and shared service accounts. Identity governance can inventory those keys. It cannot split them back into the agents and sessions behind them.
Authorization evaluates the principal, not the intent. A policy decision point checks whether this agent may call this API with these scopes. A prompt-injected agent passes that check. It holds valid credentials and requests permitted actions. The policy engine approves a confused deputy because nothing about the request looks wrong. Inline prompt inspection narrows this. It is a filter, not a record.
Delegation carries scope, not lineage. Token exchange passes permissions from a user to an agent to a tool. It does not carry the chain of decisions that produced the third call. Each hop is authorized on its own terms. No hop knows why it was invoked.
The decision log records the gate, not what passed through it. Authorization sees the request. Some platforms now capture the prompt and response as well. The artifact is still a decision, not the chain of actions behind it or the effect downstream. Once access is granted, the system that granted it has no view of what happened next.
The evidence is fragmented and self-held. An agent's activity is split across the model provider, the agent framework, the SaaS platforms it touched, and the identity platform that governed it. Each keeps its own log, on its own clock, under its own control. Reconstructing one incident means stitching together records that share no ordering and that their operators can edit.
What an agent needs
Close those gaps and the requirements are specific.
Identity that survives delegation. Every actor carries its own identity, and that identity holds through every handoff. No shared keys. No hop without a known actor.
Authority per action. One grant, scoped to one tool, one resource and one window. No standing scope to steal. Refusals are recorded too.
Context on the record. The record holds what the action did, under which grant, invoked by what, and with what context. Not just that access was granted.
Fields kept from the model. Sensitive fields are tokenized before they reach a model, so the record does not become a new leak. The record holds the tokens. Restoring a field is itself a recorded action.
Attested exchanges. Every exchange between actors is attested before it commits, so the chain can be replayed and verified by anyone who needs to.
Evidence from the enforcement point. The record is written where grants are issued and handoffs commit, not reported by the agent about itself. An agent that can be compromised cannot be its own witness.
A record no single party can rewrite. Integrity rests on a quorum, not on trusting the agent, the operator, the vendor, or the platform that produced it.
These are the properties auditors will test. The EU AI Act requires high-risk AI systems to automatically record events over their lifetime, and a log is only as useful as its integrity. US trade secret law asks whether reasonable measures protected what was taken. Permissions are part of that answer. A record is how you prove it.
How Weilliptic implements it
Each requirement maps to one layer of the stack.
Autos. One identity per autonomous actor, digital or physical, kept through every delegation.
Writ. One scoped grant per action. Refusals are recorded.
Pensieve. Agent memory and context kept as attributable state, so the context behind an action can be verified when it is read.
TCrypt. Selected fields tokenized before they reach a model, with every restoration governed and recorded.
WeilStream. Every exchange between actors attested before commit. Security, ops and finance teams can pull, replay and verify it independently.
Receipts on WeilChain. A quorum-attested record of who acted, under which grant, with what context. Receipts are emitted by the enforcement points, when Writ issues a grant and when WeilStream commits a handoff, not self-reported by the agent. Altering one means defeating the quorum. WeilChain holds that state even when participants are faulty or adversarial. Receipts reach your SIEM as OCSF, alongside the logs you already keep from model providers and SaaS platforms, so they anchor the timeline instead of adding a fifth one.
The assumption that changed
Identity and authorization assume a credentialed actor behaves as intended. Agents remove that assumption. An agent can be prompt-injected, hold valid credentials and still act against its owner. Controls that decide in advance remain necessary. They are no longer sufficient. Per-action grants shrink what a compromised agent can reach. They do not stop it from misusing what it was granted. The system also has to produce evidence afterward that does not depend on the actor, the operator, or any single party being honest.
Distributed systems settled this split years ago: admission control at the edge, and a durable, replicated log of what actually happened. Agent security will converge on the same design. The industry has built the first half quickly. The second half determines whether an incident can be resolved or only argued about.
A useful test for any agent deployment: pick one action from last week and reconstruct it. Which actor took it, under which grant, invoked by what, with what context. Then ask whether anyone outside the team that operates the agent could verify that answer. If it takes stitching logs together or trusting a vendor's export, the gap is in the record, not the access controls.
Weilliptic is building the record layer for autonomous systems. The architecture, including how Receipts are emitted and verified, is documented at docs.weilliptic.ai.