Nothing Else Happened

When something goes wrong in a database, somebody eventually asks whether anything else changed while the bad thing was happening. You can answer that question. The engine defines every operation that's possible, and every operation that occurs writes a record, so "nothing else touched this" is a claim the log can actually support. The set of things that could have happened is a list, and you have the list.

An agent working on the open web doesn't get that. Say it books a flight. Your traces show the search, the seat selection, the payment, the confirmation. What they don't show is whether the agent also accepted a cookie banner that opted you into data sharing, dismissed a modal containing arbitration terms, or left a pre-checked insurance box sitting in the cart. You can log what the agent did. You can't verify what it didn't do, because nobody enumerated what it could have done. The web doesn't publish a schema of available interactions. Every page is different, and the action space changes between requests.

More instrumentation doesn't fix this. Capture every DOM event, every network call, a screenshot per step, and what you have is a richer account of what happened. Not a bounded description of what was on the table.

The TrickyArena study (IEEE S&P 2026) put web agents on sites seeded with dark patterns, the interface tricks that get people to buy things they didn't want or consent to things they didn't read. Across agents built on GPT-4o, 41% of dark-pattern encounters ended with the agent taking the bait. Those same runs were completing their tasks. Correct product, checkout finished, unwanted warranty retained, all at once. The two results aren't in tension. Clearing whatever is in front of you is how you make forward progress through a checkout flow, and it's also how you accept a pre-checked box. Task success measured the part of the outcome someone had thought to check.

The researchers could see the rest because they built the environment. They knew which elements were traps and had the browser wired to capture everything. Nobody does that for the live web. The interactions were never enumerated in advance, so their absence can't be established afterward.

NIST's March 2026 assessment of monitoring for deployed AI systems lands in a similar place from the institutional side. It separates the question of whether a system is functioning from the question of what its functioning produced downstream, and finds that validated methods for the second remain immature.

So a trace reading "flight booked successfully" is a claim about the flight. It is silent about the rest of the session, and that silence is not information.

Which points somewhere fairly specific. If you can't bound the action space, bound the consequence space: a payment instrument with a ceiling that can't authorize recurring charges, an account that can't agree to terms on your behalf. Put verification at the handful of transitions where consequences stop being easy to undo, instead of trying to watch everything continuously. And say out loud — in the contract, the runbook, wherever people will actually read it — which consequences you undertake to inspect and where that inspection stops. Your database can support "nothing else changed" because it defines what else means. A browser session can't, and pretending otherwise only moves the surprise later.