An agent updates a customer's billing tier, submits a regulatory form, merges a pull request. Three days later the customer calls disputing the change. Or an auditor emails asking who authorized the submission. You go looking for the artifacts that explain what happened.
You have traces. You have outputs. You do not have the thing you actually need.
I've been staring at this gap for months now, and it keeps showing up in every agent conversation I have. Traces are for engineers. They capture the execution graph: model calls, tool invocations, retries, latencies. Invaluable when you're debugging a timeout at 2 AM. Outputs are for users. They capture the result: the summary, the confirmation, the thing the agent produced. Both real, both useful, and both completely useless to the person who shows up after the fact needing to decide whether to accept the work, contest it, or unwind it.
That person is legal. Compliance. The customer who says they never authorized that change. When they arrive, what they find is a trace that's too granular and too technical, or an output that's too polished and too final. The trace looks like evidence because it's detailed. The output looks like evidence because it's specific. Neither actually is. This is the precision alibi problem: specificity performing the role of verification without being verification. The detail gives you a reason not to check further, and that's exactly the wrong thing to hand someone whose job is to check further.
The evidence locker is what you build for that gap. Its audience is the stakeholder who wasn't present when the agent ran and needs enough context to make a decision. To understand who authorized the action, what policy permitted it, what the scope of delegation was, and what the path to remedy looks like if any of those answers turn out to be wrong.
And look, this gap isn't new. We've seen it before in systems that moved faster than their accountability infrastructure could handle. After the 2010 Flash Crash, the SEC had detailed audit trails from every exchange. Every event was logged. They still couldn't determine who originated orders, because the record wasn't there. Australia's Robodebt was the opposite failure: precise outputs, automated debt notices, that couldn't survive challenge because nobody had captured the evidentiary basis behind the numbers. Two failure modes, same structural gap. Agent systems are about to reproduce both at higher frequency and lower visibility, because agents act faster, across more surfaces, with less human presence per action than anything we've built before.
What goes in the locker
The locker isn't one-size-fits-all. How thick it gets depends on how hard the work is to reverse.
A drafted SQL query awaiting human review needs a thin locker: the query itself, the data sources it touches, the natural-language request that spawned it, and who asked. The human reviewer is the control surface here. The locker just supports their judgment.
A CRM field update executed directly by an agent needs more. Prior value and new value (because someone may need to put it back). The rule that permitted the change. Who delegated the authority. A timestamp precise enough to correlate with other system events. When the customer calls, you need the chain from mandate to mutation, and if you don't have it, you're guessing.
A browser-submitted financial form needs the thickest locker of all: the mandate that authorized submission, the approval chain, what was submitted, and confirmation of receipt. You cannot unsubmit something you can't prove was received. As the Verb-Noun Gap piece in this publication noted, protocols standardize verbs like tools/call long before institutional nouns like mandate and delegation scope get any formal representation. The locker is where those nouns have to live, because right now nothing else gives them a home.
Consequence is a dial, not a gate, and the locker turns with it. Today's agent frameworks give you traces, checkpoints, approval gates. They do not give you a unified per-run artifact designed for after-the-fact review by someone who wasn't there. The concept is crystallizing independently in multiple places right now, from IETF drafts to open-source receipt projects. That's usually how you know the gap is real: when people who aren't talking to each other start building the same thing.
You don't need to wait for a standard.
Every agent run produces a trace (for the engineer), an output (for the user), and a locker (for the person who shows up later asking hard questions).
Build the locker before you need it. I promise you will need it.
- Signed receipts from outside: Pipelock is an early open-source project that emits mediator-signed action receipts covering outbound HTTP, WebSocket, and MCP traffic, with each receipt linking to the prior one by hash.
- Delegation provenance drafts: Three individual IETF Internet-Drafts are independently converging on the locker's missing fields, including the Intent Provenance Protocol which proposes a signed, bounded token that travels with an agentic action from human principal to terminal act.
- OTel's sensitive-data gap: OpenTelemetry's GenAI semantic conventions record model identity, token counts, and tool-call structure, but full prompt content and tool arguments are off by default because they can contain sensitive data, which means traces may be structurally incomplete for locker purposes.
- Unauthenticated tool surfaces: A May 2026 measurement study of 7,973 live remote MCP servers found that over 40% exposed tools without authentication, which means the locker may need to record not just what authority was delegated but whether the tool endpoint verified any authority at all.