Traceability requires recording input, decision basis, and result together; missing one makes replay impossible

What it is

After a break you must be able to walk: what was fed in then, on what basis that decision was made, what the world was changed to. Trace the input-basis-result triple. Miss input, and you cannot tell whether the person’s instruction was sick or the system found the object itself; miss basis, and you cannot tell rule, model sample or human release; miss result, and you cannot tell whether the outside actually changed. Miss one of three, and replay will invent a story at the join.

A permission-use ledger is the stretch of this chain that answers “who used which ticket,” not the whole chain.

Why it happens

An agent task crosses prompt, retrieval, tool, external system. Each hop may replace the object. Store only the final artefact, and mid-hop replacements vanish; store only tool logs, and there is no “what the person saw and approved”; store only approval, and there is no whether the outside really changed. Replay wants cause, not a snapshot at either end. Version must be pinned too: the same input yields another result after a model update; without version, basis drifts.

Reproducibility on the generation side wants the sample stored; on the agent side it also wants tool returns, because world state is part of the basis.

Studying it

Run a harmful path, then let an investigator who was not there answer three questions from records alone: what was the input, what was the basis, what was the external result. Compare records missing input, missing basis, missing external check. Dependent variables: accuracy on the three, whether an engineer must rummage several systems, which stretch a wrong attribution lands on. Independent variables: whether model version is included, whether a snapshot of human release is included, whether external check is automatic.

If the three cannot be fully answered, tracing does not hold. Answerable only by joining four logs does not hold for a person either.

Where it stops holding

A purely local draft with no outward, result can be an internal snapshot. How long to keep is the next question; here the fields must first exist. Rung awareness is whether the person knew which level they were on then — another kind of fact. When systems are chained, the triple must be written once at each segment boundary, or the chain breaks at the join.

Applying it

• Every outward act writes one triple: input (prompt / object / human release), basis (rule / model version / tool return), result (ground truth from the external system, not a product badge).
• An investigation UI lays the triple for an object on one screen; do not hide basis in a stack only an engineer can grep.
• Check: take the engineers away, give an investigator an object name. If one of the three cannot be answered, one is missing. Run again deliberately without model version — the basis question will fall first, which is how you know version is part of basis.

Related

• Same group: L4.15.1 Degree of automation allocates responsibility, but users usually do not know which tier they are on · L4.15.3 Logs must be kept until accountability might arise, not only as long as debugging needs them · L4.15.4 Handing final confirmation to a person does not mean responsibility has been fairly transferred; the person must have the conditions to refuse · L4.15.5 When systems are chained, the responsibility chain breaks at the interfaces; each segment's boundary must be drawn in advance
• Nearby: L4.06 Permission Boundaries of Agents · L1.11 Reproducibility of Non-deterministic Output · L4.08 Visibility of Task Progress
• Search terms: traceability · audit trail · after-action review