Responsible Agentic AI Requires Explicit Provenance

# Responsible Agentic AI Requires Explicit Provenance
Source: [https://arxiv.org/html/2605.17169](https://arxiv.org/html/2605.17169)
Jinwei Hu1, Xinmiao Huang1, Qisong He1, Youcheng Sun2, Yi Dong1, Xiaowei Huang1 1School of Computer Science and Informatics, University of Liverpool, UK 2Department of Computer Science, Mohamed bin Zayed University of Artificial Intelligence, UAE

###### Abstract

Agentic AI is rapidly proliferating across diverse real\-world domains such as software engineering, yet public trust has not kept pace\. The central reason is that responsibility, despite being widely discussed, remains a subjective and unenforced concept, as no current agentic framework produces the quantifiable, traceable, and interventionable provenance needed to assign it when harm emerges from compositions no single party designed\. We position that what is missing is not better benchmark\-level evaluation butexplicit provenanceacross the full agentic lifecycle, which is the only viable basis for making responsibility computable and actionable\. We advance this agenda along four axes: establishingwhysuch provenance is a structural necessity by identifying responsibility gaps across sociotechnical dimensions, formalizingwhatit must encode through a causal attribution function and responsibility tensor, discussinghowit can be made computable across four lifecycle layers with preliminary experiments showing that provenance is estimable and interveneable online before irreversible harm accumulates, and examiningwhobears responsibility through a concrete agentic incident\. Explicit provenance is not a discretionary refinement but the necessary condition for responsible agentic AI, and no stakeholder across its ecosystem can afford to treat it as optional\.

## 1Introduction

![Refer to caption](https://arxiv.org/html/2605.17169v1/figures/motivation_structure.png)Figure 1:Per\-component trustworthy AI audits components in isolation \(1\), but agentic AI embeds them in long\-horizon action loops that produce emergent harms, unanticipated compositional consequences, and diffused responsibility \(2\)\. Closing this gap requires explicit provenance across the full lifecycle of responsible agentic AI and we demonstrate it via four axes \(3\)\.Artificial intelligence \(AI\) has recently undergone three transitions in the scope of its action\. Early AI systems were largely reactive: inputs in, outputs out\. A second generation, grounded in large language models \(LLMs\)\(Brownet al\.,[2020](https://arxiv.org/html/2605.17169#bib.bib1); Achiamet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib2); Touvronet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib3)\), shifted the focus from prediction to open\-ended text generation\. A third transition is now underway:*agentic AI*, in which models are embedded in autonomous action loops, equipped with tools and persistent memory, integrated into multi\-agent pipelines, and granted authority to plan, execute, and revise decisions over extended horizons\(Wanget al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib4); Xiet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib5); Jianget al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib6)\)\. This transition changes the object of concern: an agentic system does not merely answer questions, but acts in the real world by booking flights, executing code, sending emails, and coordinating with other autonomous systems, often with little or no human intervention\(Parket al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib7); Honget al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib8); Wuet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib9); Huet al\.,[2026a](https://arxiv.org/html/2605.17169#bib.bib10); Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11)\)\.

Yet despite this rapid proliferation, enterprise surveys report that real\-world adoption remains far below the pace of development and organizations scale capability faster than they are willing to delegate authority\(McKinsey & Company,[2026](https://arxiv.org/html/2605.17169#bib.bib27); Deloitte,[2026](https://arxiv.org/html/2605.17169#bib.bib29)\)\. The practical consequence is an adoption bottleneck rooted in a trust deficit\. Users, organizations, and regulators hesitate to grant consequential authority to systems whose actions leave no traceable record of how decisions were reached, by whom, and through which causal chain\. This is not irrational caution but a predictable response to structural unaccountability: when harm occurs, each party points to another and responsibility dissolves before it can be assigned\. Responsibility has been widely discussed in the trustworthy AI literature\(Liuet al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib12); Liet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib13)\), yet it has never been made computable or actionable across the full agentic lifecycle, not for lack of normative vocabulary but for lack of the explicit provenance\. Consider a case where individually audited skills each pass safety review, yet their composition within an LLM\-based agent produces regulatory violations that no per\-skill audit could have detected: no party can be held accountable precisely because no responsibility envelope was specified before deployment to bound each party’s obligations, and no record exists of how the harmful trajectory was jointly produced\.

This failure is not incidental but structural, as harm in agentic systems does not reside in any single component but emerges from system\-level trajectories, compositions, and distributed causal chains that no individual audit can inspect\(Chanet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib15)\)\. Existing records are designed around per\-component failures and therefore remain too coarse to support causal responsibility attribution or its traceability across parties, and their post\-hoc nature means that intervention cannot be mounted until after harm has already occurred\(Ojewaleet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib43)\)\.We therefore position that responsible agentic AI must be quantifiable, traceable and interventionable across the full lifecycle, and that explicit provenance is the necessary infrastructure for making the responsibility computable and actionable\.Without it, responsibility remains an subjective concept that cannot be assigned, or enforced, and benchmark\-driven evaluation, while necessary for component\-level capability, neither reaches compositional behavior nor produces the causal attribution that the responsibility requires\.

This paper therefore advances a provenance\-grounded agenda for computable and actionable responsibility in agentic AI along four axes\. We first establishwhyexplicit provenance is a structural necessity rather than a discretionary refinement, identifying socio\-technical responsibility gaps \(Section[3](https://arxiv.org/html/2605.17169#S3)\)\. We then formalizewhatprovenance must encode in agentic contexts through a causal attribution function and an responsibility tensor \(Section[4](https://arxiv.org/html/2605.17169#S4)\)\. We addresshowresponsibility can be made computable across four lifecycle layers, validated through preliminary experiments showing that causal contribution is estimable online before irreversible harm accumulates \(Section[5](https://arxiv.org/html/2605.17169#S5)\)\. Finally, we examinewhobears responsibility by applying the responsibility tensor to a concrete agentic incident, demonstrating how provenance distributes obligations \(Section[6](https://arxiv.org/html/2605.17169#S6)\)\.

## 2Background

Agentic AI now appears across diverse domains, from software automation to professional decision support\(Yaoet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib16); Schicket al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib17); Zhouet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib18); HUet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib19); Xuet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib20)\)\. Thus, we adopt a general functional definition centered on the capabilities that make these systems consequential\.

###### Definition 2\.1\(Agentic AI System\)\.

An agentic AI system situates one or more LLM\-based agents within a perception\-action loop with \(i\)*tool access*, \(ii\)*persistent memory*, \(iii\)*multi\-step planning*, and \(iv\)*self\-correction*, optionally coordinating with other agents\.

Agentic adoption is outpacing responsibility structures\.Frontier providers are productizing agents that use tools, operate computers, and complete multi\-step tasks, while open ecosystems such as OpenClaw and ClawHub illustrate the emergence of third\-party skill marketplaces where agents can be extended with externally authored capabilities\(OpenAI,[2025a](https://arxiv.org/html/2605.17169#bib.bib21),[b](https://arxiv.org/html/2605.17169#bib.bib22); Anthropic,[2026](https://arxiv.org/html/2605.17169#bib.bib23); OpenClaw,[2026b](https://arxiv.org/html/2605.17169#bib.bib24),[a](https://arxiv.org/html/2605.17169#bib.bib25)\)\. Enterprise surveys confirm that adoption is already at scale: McKinsey reports that 23% of respondents are scaling agentic AI systems and another 39% experimenting, and PwC reports that 79% of senior executives say AI agents are already being adopted in their companies\(McKinsey & Company,[2025](https://arxiv.org/html/2605.17169#bib.bib26); PwC,[2025](https://arxiv.org/html/2605.17169#bib.bib28)\)\. Yet responsibility structures remain less mature, with McKinsey identifying persistent gaps in governance and risk management and Deloitte characterizing agentic AI as scaling faster than its guardrails\(McKinsey & Company,[2026](https://arxiv.org/html/2605.17169#bib.bib27); Deloitte,[2026](https://arxiv.org/html/2605.17169#bib.bib29)\)\. Agentic AI is therefore not merely a capability frontier but a responsibility frontier\.

Relation to trustworthy AI and adjacent work\.The trustworthy AI paradigm has organized safety around model\-level properties, benchmark evaluation, and red\-teaming\([Lianget al\.,](https://arxiv.org/html/2605.17169#bib.bib30); Ganguliet al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib31); Sunet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib32)\), but agentic deployment exposes three structural limitations\. Risks is*compositional*: properties verified for individual components need not survive their interaction\(Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11)\)\. Evaluation is*fragile*: task completion can diverge from safety, policy compliance, and harmfulness control\([Andriushchenkoet al\.,](https://arxiv.org/html/2605.17169#bib.bib33);[Kuntzet al\.,](https://arxiv.org/html/2605.17169#bib.bib34); Huet al\.,[2026b](https://arxiv.org/html/2605.17169#bib.bib35)\)\. Accountability is*diffuse*: harmful outcomes arise from multi\-step trajectories distributed across developers, platforms, and deployers that no per\-component audit can reconstruct\(Stauferet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib36)\)\. Existing accountability work provides foundations for auditing and institutional oversight\(Doshi\-Velezet al\.,[2017](https://arxiv.org/html/2605.17169#bib.bib37); Wieringa,[2020](https://arxiv.org/html/2605.17169#bib.bib38)\), but assumes bounded decisions and inspectable systems that agentic AI renders obsolete: harm may emerge from long\-horizon trajectories, persistent memory, and third\-party skills that no single actor designed or controlled end\-to\-end\. Responsibility discourse in moral philosophy, legal theory, and AI governance is extensive\(Vincentet al\.,[2011](https://arxiv.org/html/2605.17169#bib.bib40); Porteret al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib41); Novelliet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib42)\), yet none of these bodies of work produces the explicit provenance that makes responsibility computable when harm emerges from compositional agentic behavior rather than from any identifiable single decision\.

## 3Why Responsible Agentic AI Requires Explicit Provenance

Across the limitations identified in Section[2](https://arxiv.org/html/2605.17169#S2), responsibility remains uncomputable due to no party produces the explicit provenance needed to assign responsibility when harm emerges from individually compliant components\. We therefore characterize what any responsible agentic system must satisfy\.

###### Proposition 3\.1\(Structural Requirement of Responsible Agentic AI\)\.

A responsible agentic system requires explicit provenance satisfying three properties\. First,*quantifiability*, meaning it produces measurable causal attribution for each component and corresponding party\. Second,*traceability*, meaning it grounds responsibility assignments in causally verified execution records and epistemic position\. Third,*interventionability*, meaning it is produced continuously so that agentic systems remain open to interception and recovery across the lifecycle\.

The following analysis demonstrates, for each property, why its absence leaves the corresponding sociotechnical dimensions unresolvable\. These eight dimensions are representative rather than exhaustive, synthesized from the adjacent literature on responsible AI\(Vincentet al\.,[2011](https://arxiv.org/html/2605.17169#bib.bib40); Matthias,[2004](https://arxiv.org/html/2605.17169#bib.bib45); Vladeck,[2014](https://arxiv.org/html/2605.17169#bib.bib46); Cobbeet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib50); Dafoe,[2018](https://arxiv.org/html/2605.17169#bib.bib57); Huet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib61); Porteret al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib41)\)\.

### 3\.1Sociotechnical Demonstration of Responsibility Gaps

#### Quantifiability\.

LawandMoralityboth require an identifiable causal agent whose contribution to a harm can be established\. No party manufactures an agentic composition, so the EU AI Liability Directive’s presumption of fault cannot attach when harm is a property of component interaction rather than any individual component\(Vladeck,[2014](https://arxiv.org/html/2605.17169#bib.bib46); Commission and others,[2022](https://arxiv.org/html/2605.17169#bib.bib47); Balke and Eymann,[2008](https://arxiv.org/html/2605.17169#bib.bib48); Oliver,[2021](https://arxiv.org/html/2605.17169#bib.bib49); Cobbeet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib50)\)\. Morally, agentic causation is distributed across developers, skill maintainers, and platform operators in proportions no party designed or anticipated, so no party clears the culpability threshold and victims have no one to hold accountable\(Matthias,[2004](https://arxiv.org/html/2605.17169#bib.bib45); Vallor and Vierkant,[2024](https://arxiv.org/html/2605.17169#bib.bib51); Choet al\.,[2015](https://arxiv.org/html/2605.17169#bib.bib52)\)\. At the technical level,Standardscan make responsibility actionable only if they specify what causal attribution a system must produce to demonstrate responsible deployment; without this, every party defines responsible deployment on its own terms and no objective criterion exists to determine whether any obligation was met or breached\(Huet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib61); Rajiet al\.,[2020](https://arxiv.org/html/2605.17169#bib.bib62)\)\.Regulationfaces the same dependency\. Mandatory requirements can close the accountability gap only if they specify what quantifiable attribution parties must produce as a precondition for market participation, since in open agentic marketplaces compositional safety testing generates collective benefits but imposes private costs, making zero investment the individually rational outcome absent such requirements\(Dafoe,[2018](https://arxiv.org/html/2605.17169#bib.bib57); McKinsey & Company,[2026](https://arxiv.org/html/2605.17169#bib.bib27); Deloitte,[2026](https://arxiv.org/html/2605.17169#bib.bib29)\)\. Without quantifiability, no legal, moral, standards\-based, or regulatory framework can identify which party contributed what influence, leaving all four dimensions permanently unresolvable regardless of how well individual components are audited\.

#### Traceability\.

EthicsandValuesframeworks are designed to prevent harms that accumulate gradually across interactions rather than materializing at any single step\. Agentic systems accumulate effects across weeks or months that no per\-interaction audit detects\(Gabrielet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib53)\): autonomy erodes as delegation narrows users’ effective choices\(Moket al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib54)\), and compositional bias amplification compounds small discriminatory signals into population\-scale outcomes invisible at any single step\(Ferrara,[2024](https://arxiv.org/html/2605.17169#bib.bib55); Yinet al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib56); Bommasaniet al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib59); Leeet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib60)\)\. Without traceability that grounds cumulative causal attribution across interactions and populations, these harms remain structurally invisible to any responsibility framework\. At the technical level,Practicefailures are invisible to per\-component auditing for the same reason: no traceable causal attribution of the joint trajectory is available\. Indirect prompt injection succeeds with attack rates reaching 47% against GPT\-4 across 17 tool\-integrated systems\(Zhanet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib63)\); over 68% of sandbox scenarios exhibit potential real\-world agent failures\([Ruanet al\.,](https://arxiv.org/html/2605.17169#bib.bib64)\); individually valid skills introduce composition risks that reduce task performance\(Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11)\); and over 90% of high\-popularity skills in ClawHub fail security review\(Guoet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib65)\)\. In every case, the failure is a system\-level property that only trajectory\-level traceability can reconstruct and attribute\.

#### Interventionability\.

Professionalismconcerns the boundary beyond which delegating consequential decisions to an agentic system is not legitimate\. In regulated domains such as medicine\(Habliet al\.,[2020](https://arxiv.org/html/2605.17169#bib.bib66)\), professional obligations cannot be transferred to an automated system on benchmark accuracy alone: benchmarks cover in\-distribution tasks while deployment exposes systems to rare events and novel authority\-boundary situations that benchmarks do not represent\(Yuanet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib67); Luet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib68)\)\. Without interventionability that continuously monitors whether automated authority remains within validated boundaries and intercepts execution when it does not, no mechanism can prevent irreversible harm from accumulating in the uncovered region\. The same requirement applies to the gradual harms identified underEthicsandValues: harms that build across interactions without crossing any single detectable threshold can only be interrupted by a system that produces provenance continuously and acts on it in real time\. Without interventionability, explicit provenance reduces to a forensic instrument and responsible operation across the lifecycle cannot be guaranteed\.

#### Explicit Provenance as Necessary Infrastructure\.

The socio\-technical analysis above shows the three properties are jointly necessary rather than independently sufficient\. Quantifiability without traceability leaves contested assignments unresolvable, traceability without interventionability confines attribution to post\-hoc reconstruction, and interventionability without quantifiability produces continuous monitoring with no basis for assigning what was detected to any responsible party\. Since real deployments routinely instantiate gaps across all three classes simultaneously, Proposition[3\.1](https://arxiv.org/html/2605.17169#S3.Thmtheorem1)cannot be satisfied without explicit provenance as the underlying infrastructure that makes all three properties simultaneously operational\.

## 4What Explicit Provenance Must Encode

This section formalizes what explicit provenance must capture to make sociotechnical responsibility computable in agentic AI\. The central question is not only which parties bear responsibility when harm emerges from an agentic trajectory, but what causal and epistemic evidence must be produced and maintained to make that assignment possible\. The formalization is guided by three requirements established in Proposition[3\.1](https://arxiv.org/html/2605.17169#S3.Thmtheorem1)and the definitions below instantiate these requirements and provide the formal basis for computable responsibility assignment\.

### 4\.1Causal and Epistemic Grounding of Explicit Provenance

Let𝒜=\{a1,…,an\}\\mathcal\{A\}=\\\{a\_\{1\},\\ldots,a\_\{n\}\\\}be the set of agents,𝒮=\{s1,…,sm\}\\mathcal\{S\}=\\\{s\_\{1\},\\ldots,s\_\{m\}\\\}the set of skills or tools andℰ\\mathcal\{E\}the environment state space\. An*agentic trajectory*is a finite sequenceτ=\(e0,α0,e1,α1,…,eT\)\\tau=\(e\_\{0\},\\alpha\_\{0\},e\_\{1\},\\alpha\_\{1\},\\ldots,e\_\{T\}\), whereet∈ℰe\_\{t\}\\in\\mathcal\{E\}is the environment state andαt=\(αt1,…,αtn\)\\alpha\_\{t\}=\(\\alpha\_\{t\}^\{1\},\\ldots,\\alpha\_\{t\}^\{n\}\)is the joint agent action at steptt\. Actions may include model outputs, tool calls, skill invocations, inter\-agent messages, or external operations\. A*harm event*ω∈Ω\\omega\\in\\Omegais a measurable consequence ofτ\\tauthat negatively affects stakeholders\. Let𝒫=\{pi→Mi\}i=1r\\mathcal\{P\}=\\\{p\_\{i\}\\to M\_\{i\}\\\}\_\{i=1\}^\{r\}denote the deployment\-chain accountability dictionary overrrparties, wherepip\_\{i\}is a human party andMiM\_\{i\}is the set of technical components \(e\.g\., foundation models, skills and tools\) developed, deployed, or maintained bypip\_\{i\}\. Since harm in agentic systems can emerge from an extended trajectory rather than a single decision, responsibility assignment first requires a measure of each deployment\-chain party’s causal contribution to the harmful outcome\. Hence, producing and maintaining this measure is the first class of evidence that explicit provenance must encode\.

###### Definition 4\.1\(Causal Contribution\)\.

LetPr⁡\[ω∣τ\]\\Pr\[\\omega\\mid\\tau\]denote the probability that harm eventω\\omegaoccurs under trajectoryτ\\tau\. The causal contribution of partyppis

κ​\(p,ω,τ\)=Pr⁡\[ω∣τ\]−Pr⁡\[ω∣τ−p\],\\kappa\(p,\\omega,\\tau\)=\\Pr\[\\omega\\mid\\tau\]\-\\Pr\[\\omega\\mid\\tau\_\{\-p\}\],whereτ−p\\tau\_\{\-p\}denotes a counterfactual trajectory under a role\-preserving intervention that removes or neutralizespp’s relevant decisions while holding other conditions fixed where meaningful\.κ​\(p,ω,τ\)\>0\\kappa\(p,\\omega,\\tau\)\>0iffpphas nonzero causal contribution\.

Remark 4\.1\.κ\\kappais a theoretical anchor rather than a directly observed quantity\. Recent work on auditable and traceable LLM agents suggests that causal evidence can be approximated from execution traces, tool\-activation records, permission boundaries, counterfactual replay, and controlled ablations\(Ojewaleet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib43); Zhanget al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib79);[Andriushchenkoet al\.,](https://arxiv.org/html/2605.17169#bib.bib33); Zhanget al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib44)\)\. The role ofκ\\kappais therefore not to assume perfect attribution, but to specify the kind of evidence that responsibility analysis should seek when attribution is contested\. We provide preliminary evidence in Section[5\.5](https://arxiv.org/html/2605.17169#S5.SS5)that causal signal is estimable online from execution prefixes across heterogeneous agent environments, establishing the tractability ofκ\\kappaat runtime\. Attribution to human parties follows directly from the mapping in𝒫\\mathcal\{P\}, in which each component is assigned to the party that developed, deployed, or maintained it\.

Moreover, causal contribution alone is insufficient for responsibility assignment, as a party’s responsibility also depends on what it knew, or should reasonably have known, before the harm occurred\. Each party’s epistemic position therefore constitutes the second class of evidence that explicit provenance must encode, and we define it using an objective standard so that parties cannot evade responsibility by manufacturing ignorance through incomplete documentation or inadequate safety assessment\.

###### Definition 4\.2\(Epistemic Position\)\.

εpt=\(ℐpt,𝒞pt\)\\varepsilon\_\{p\}^\{t\}=\(\\mathcal\{I\}\_\{p\}^\{t\},\\mathcal\{C\}\_\{p\}^\{t\}\), whereℐpt\\mathcal\{I\}\_\{p\}^\{t\}is the information available or reasonably expected to be available to partyppat timett, and𝒞pt⊆Ω\\mathcal\{C\}\_\{p\}^\{t\}\\subseteq\\Omegais the set of harm eventsppcould have reasonably foreseen givenℐpt\\mathcal\{I\}\_\{p\}^\{t\}, assessed against the*objective standard*of what a reasonably informed actor inpp’s role should have anticipated\. Partyppis*epistemically culpable*forω\\omegaifω∈𝒞pt\\omega\\in\\mathcal\{C\}\_\{p\}^\{t\}for somettprior to the harm\.

### 4\.2From Explicit Provenance to Computable Responsibility

The preceding definitions establish the causal and epistemic evidence that explicit provenance must encode, separating two conditions for responsibility into a universal function over responsible parties\.

###### Definition 4\.3\(Computable Responsibility in Agentic System\)\.

The responsibility assignment functionρ:𝒫×Ω→\[0,1\]\\rho:\\mathcal\{P\}\\times\\Omega\\to\[0,1\]assigns an individual responsibility weight to each deployment\-chain partyppfor each harm eventω\\omega\. It satisfies:

1. 1\.Proportionality\.ρ​\(p,ω\)∝κ​\(p,ω,τ\)⋅𝟏​\[ω∈𝒞pt\]\\rho\(p,\\omega\)\\propto\\kappa\(p,\\omega,\\tau\)\\cdot\\mathbf\{1\}\[\\omega\\in\\mathcal\{C\}\_\{p\}^\{t\}\], where𝟏​\[ω∈𝒞pt\]\\mathbf\{1\}\[\\omega\\in\\mathcal\{C\}\_\{p\}^\{t\}\]is an indicator function that equals11ifω\\omegabelongs to the set of harms reasonably foreseeable to partyppat timett\.
2. 2\.Completeness\.For every harm eventω\\omega,∑p∈𝒫ρ​\(p,ω\)\+ρinst​\(ω\)=1\\sum\_\{p\\in\\mathcal\{P\}\}\\rho\(p,\\omega\)\+\\rho\_\{\\mathrm\{inst\}\}\(\\omega\)=1, whereρinst​\(ω\)\\rho\_\{\\mathrm\{inst\}\}\(\\omega\)denotes residual institutional responsibility\. When individual assignment is incomplete, the residual should be assigned to the institutional layer \(Definition[4\.4](https://arxiv.org/html/2605.17169#S4.Thmtheorem4)\)\.
3. 3\.Non\-evasion\.ρ​\(p,ω\)\>0\\rho\(p,\\omega\)\>0wheneverκ​\(p,ω,τ\)\>0\\kappa\(p,\\omega,\\tau\)\>0andω∈𝒞pt\\omega\\in\\mathcal\{C\}\_\{p\}^\{t\}for somettprior to the harm\. Thus, real and foreseeable contribution cannot be erased by system complexity\.

Remark 4\.3\.Proportionality ties responsibility to causal contribution under reasonable foreseeability\. Completeness assigns residual responsibility institutionally rather than leaving it unaccounted and serves as the normalization constraint that makes the proportionality relation precise\. Non\-evasion prevents foreseeable contributors from escaping responsibility through system complexity\(Matthias,[2004](https://arxiv.org/html/2605.17169#bib.bib45)\)\. Together, these conditions make responsibility an allocative structure\.

Finally, the institutional layer captures residual responsibility that cannot be exhausted by individual causal contribution and foreseeability\. We define residual institutional responsibility as below:

###### Definition 4\.4\(Residual Institutional Responsibility\)\.

Residual institutional responsibility is the portion of responsibility not assigned to individual deployment\-chain parties:ρinst​\(ω\)=1−∑p∈𝒫ρ​\(p,ω\)≥0\\rho\_\{\\mathrm\{inst\}\}\(\\omega\)=1\-\\sum\_\{p\\in\\mathcal\{P\}\}\\rho\(p,\\omega\)\\geq 0\. It is borne by the institutional layer when that layer had the authority and capacity to close or absorb the accountability gap through standards, certification, monitoring, incident response, or compensation mechanisms, but failed to do so\.

### 4\.3Distributing Responsibility Across Deployment\-Chain Parties

Responsibility assignment requires decomposing an observed harm eventω\\omegainto component\-level causal contributions and mapping them back to the parties that bear them\. We use the scalarρ​\(p,ω\)\\rho\(p,\\omega\)to quantify each component’s individual contribution, and the deployment\-chain dictionary𝒫=\{pi→Mi\}i=1r\\mathcal\{P\}=\\\{p\_\{i\}\\to M\_\{i\}\\\}\_\{i=1\}^\{r\}to map each contributing component to its responsible party\. Since agentic harm typically implicates multiple parties across multiple socio\-technical dimensions simultaneously, we define the responsibility tensor to make this full allocation structure explicit and computable\.

###### Definition 4\.5\(Responsibility Tensor\)\.

Let𝒟=\{d1,…,dk\}\\mathcal\{D\}=\\\{d\_\{1\},\\ldots,d\_\{k\}\\\}be the set of socio\-technical responsibility dimensions specified for the deployment context\. The responsibility tensor𝐑∈\[0,1\]\|𝒫\|×\|Ω\|×\|𝒟\|\\mathbf\{R\}\\in\[0,1\]^\{\|\\mathcal\{P\}\|\\times\|\\Omega\|\\times\|\\mathcal\{D\}\|\}encodes dimension\-specific responsibility, where𝐑​\[p,ω,dk\]\\mathbf\{R\}\[p,\\omega,d\_\{k\}\]denotes partypp’s responsibility for harm eventω\\omegaalong dimensiondkd\_\{k\}\. The scalar assignment is recovered asρ​\(p,ω\)=∑k=1\|𝒟\|wk​𝐑​\[p,ω,dk\]\\rho\(p,\\omega\)=\\sum\_\{k=1\}^\{\|\\mathcal\{D\}\|\}w\_\{k\}\\mathbf\{R\}\[p,\\omega,d\_\{k\}\], wherewk\>0w\_\{k\}\>0reflects the relative significance of dimensiondkd\_\{k\}in the deployment context, with∑k=1\|𝒟\|wk=1\\sum\_\{k=1\}^\{\|\\mathcal\{D\}\|\}w\_\{k\}=1\.

The weightswkw\_\{k\}reflect the relative significance of each responsibility dimension and should be explicitly recorded in the agentic context\. A key advantage of this formalization is that the tensor remains computable from𝒫\\mathcal\{P\}even without full provenance by reducing to party identification alone, ensuring responsible parties can always be identified; with explicit provenance, each entry is causally grounded, making responsibility attribution actionable across the lifecycle\.

## 5How Explicit Provenance Makes Responsibility Computable

This section addresses how explicit provenance can be produced across the full agentic lifecycle\. The central obstacle is thatκ​\(p,ω,τ\)\\kappa\(p,\\omega,\\tau\)requires estimatingPr⁡\[ω∣τ\]\\Pr\[\\omega\\mid\\tau\], a quantity not directly recoverable from raw execution logs without structured, failure\-aligned provenance records\. Making explicit provenance operational therefore requires progress across four sequentially dependent layers: L1 establishes the causal structure that L2 must instrument, L2 produces the execution records that L3 translates into normative judgments, and L3 establishes the accountability structure that L4 must extend to population scale\. Without progress on all four layers, responsibility will remain a theoretical construct rather than an operational instrument\.

### 5\.1L1: Design

Quantifiability requires the causal structure of an agentic system be known before harm occurs\(Peterset al\.,[2017](https://arxiv.org/html/2605.17169#bib.bib75); Geigeret al\.,[2021](https://arxiv.org/html/2605.17169#bib.bib76)\)\. The explicit provenance needed to approximate causal signal from execution must be designed into the system, not merely relying on reconstructed post\-hoc logs\. We represent this structure as a multilevel dependency graph𝒢=\(𝒱,ℰ\)\\mathcal\{G\}=\(\\mathcal\{V\},\\mathcal\{E\}\), where𝒱\\mathcal\{V\}spans parties, models, skills, and their underlying components, andℰ\\mathcal\{E\}encodes causal influence across levels\. Current practice does not meet this requirement: skills, tools, agents, and parties are composed without documenting causal dependencies\(Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11); Guoet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib65)\)\. The result is thatPr⁡\[ω∣τ\]\\Pr\[\\omega\\mid\\tau\]is unestimable not because the mathematics fails but because the system was never designed to produce the provenance that quantifiability requires\. The research agenda this motivates iscausal decomposition of compositional agentic systems, representing multilevel dependency structure in a form that supports provenance production at any granularity, and establishing what constitutes a meaningful component boundary through interdisciplinary engagement with law, ethics, and domain expertise\(Donget al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib77)\)\.

### 5\.2L2: Engineering

Even with a well\-defined causal structure at design time, explicit provenance remains unproduced if the execution record does not capture the evidence required to evaluateκ\\kappaandεpt\\varepsilon\_\{p\}^\{t\}\. This engineering barrier has two dimensions corresponding to traceability and interventionability respectively\. Traceability requiresretrospective coverage: without structured, failure\-aligned representations of each execution step, the causal signal required to estimatePr⁡\[ω∣τ\]\\Pr\[\\omega\\mid\\tau\]cannot be recovered from raw logs, and the epistemic records needed to establishεpt\\varepsilon\_\{p\}^\{t\}are lost\(Ojewaleet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib43)\)\. Interventionability requiresprospective coverage: agentic systems routinely take irreversible actions, meaning that provenance available only after harm has materialized cannot support interception or recovery\. Responsible agentic AI must therefore be equipped with the capacity to estimate trajectory risk in real time and interrupt execution before irreversible consequences accumulate\. Both gaps map directly into unresolvableρinst\\rho\_\{\\mathrm\{inst\}\}\.

The research agenda this layer motivates has two components that together address traceability and interventionability\. First,online trajectory monitoring and risk estimation: agentic systems require monitors that produce structured, inspectable causal representations from execution traces in real time and estimatePr⁡\[ω∣et,αt:T\]\\Pr\[\\omega\\mid e\_\{t\},\\alpha\_\{t:T\}\]before irreversible consequences accumulate, whereet∈ℰe\_\{t\}\\in\\mathcal\{E\}is the current environment state andαt:T=\(αt,…,αT\)\\alpha\_\{t:T\}=\(\\alpha\_\{t\},\\ldots,\\alpha\_\{T\}\)is the planned action sequence to deployment\-specified horizonTT\. Such monitors must be both flexible enough to handle heterogeneous traces and inspectable enough to serve as evidence in attribution\(Rudin,[2019](https://arxiv.org/html/2605.17169#bib.bib80)\)\. Neuro\-symbolic approaches are a promising direction precisely because they combine representational flexibility with auditable intermediate reasoning states\(Garcez and Lamb,[2023](https://arxiv.org/html/2605.17169#bib.bib78); Zhanget al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib79),[2026](https://arxiv.org/html/2605.17169#bib.bib44)\)\. Second,compositional verification of responsibility attribution: whenever a new componentxnewx\_\{\\text\{new\}\}enters the system, the shift in causal attributionΔ​κ​\(p,ω,τ,xnew\)=κ​\(p,ω,τ∣𝒢⊕xnew\)−κ​\(p,ω,τ∣𝒢\)\\Delta\\kappa\(p,\\omega,\\tau,x\_\{\\text\{new\}\}\)=\\kappa\\\!\\left\(p,\\omega,\\tau\\mid\_\{\\mathcal\{G\}\\oplus x\_\{\\text\{new\}\}\}\\right\)\-\\kappa\(p,\\omega,\\tau\\mid\_\{\\mathcal\{G\}\}\), where𝒢⊕xnew\\mathcal\{G\}\\oplus x\_\{\\text\{new\}\}must be tested before co\-activation is permitted, ensuring that quantifiability is maintained as the system grows\(Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11)\)\.

### 5\.3L3: Deployment

L1 and L2 establish the technical infrastructure for explicit provenance, makingκ​\(p,ω,τ\)\\kappa\(p,\\omega,\\tau\)computable from execution records andεpt\\varepsilon\_\{p\}^\{t\}reconstructable from structured logs, but translating provenance into a fully populated responsibility tensor𝐑​\[p,ω,dk\]\\mathbf\{R\}\[p,\\omega,d\_\{k\}\]requires human judgment that technical systems cannot produce on their own\. Each normative dimension of𝐑\\mathbf\{R\}depends on decisions about foreseeability, authority, and obligation that must be made and documented by human actors before deployment\. The deployment layer is therefore where quantifiability and traceability are translated into actionable responsibility assignments, and where the institutional conditions for interventionability are established so that agentic systems have the authority and procedures to intercept and recover from harmful trajectories\(Novelliet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib42)\)\. How dimension weightswkw\_\{k\}should be specified and adapted as harm evidence accumulates remains an open research direction; precedents from safety\-critical domains\(Wanget al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib83); Angelopouloset al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib84)\)suggest that data\-driven weight updating is both feasible and necessary for contextually grounded responsibility allocation across diverse deployment contexts\.

###### Definition 5\.1\(Deployment Readiness Condition\)\.

A responsible agentic system satisfies the deployment readiness condition iff: \(i\) the causal dependency structure is documented at all component levels; \(ii\) compositional verification covers all component combinations with nonzero co\-activation probability; \(iii\) all parties have established a responsibility envelope documenting their obligations and intervention boundaries to downstream parties, with dimension weightswkw\_\{k\}specified for the deployment context; \(iv\) incident response plans have been exercised with human participants; \(v\) informed consent mechanisms have been validated with users\.

### 5\.4L4: Experience

The preceding layers makeκ\\kappacomputable for harm events at identifiable trajectory points, but do not address harm that builds up gradually across interactions without any single event crossing a detectable threshold, the mechanism identified as autonomy erosion and compositional bias amplification\(Gabrielet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib53)\)\. The relevant counterfactual is not what would have happened in this trajectory withoutpp, but how the user’s beliefs and choices would have differed without the system’s persistent influence, which requires tracking divergence across trajectories at population scale and cannot be answered by per\-interaction audit alone\(Bommasaniet al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib59)\)\. This gap extends all three provenance properties beyond what L1 through L3 reach, as quantifiability must cover cumulative causal contributions across interactions, traceability must ground assignments in population\-level execution records, and interventionability must support recovery before gradual harms become irreversible at scale\. This motivates two complementary research directions\. The first is population\-scale monitoring of how much the system narrows users’ actual choice sets relative to a counterfactual baseline, aggregated in ways sensitive to distributional harm, with thresholds for triggeringρinst\\rho\_\{\\mathrm\{inst\}\}jointly specified by technical and social science communities\(Bommasaniet al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib59)\)\. The second is populating the user\-relevant dimension of𝐑\\mathbf\{R\}on evidential rather than assumed grounds, since𝒞usert\\mathcal\{C\}^\{t\}\_\{\\mathrm\{user\}\}is non\-empty only when meaningful risk information was disclosed before interaction, and responsibility regimes should not require technical literacy beyond what a reasonable user can be expected to have\(Doshi\-Velezet al\.,[2017](https://arxiv.org/html/2605.17169#bib.bib37)\)\. The first captures cumulative harm that falls outside individualκ\\kappaassignments, while the second ensures that user\-side entries in𝐑\\mathbf\{R\}reflect what users were actually in a position to foresee\.

### 5\.5Neuro\-Symbolic Trial for Explicit Provenance

![Refer to caption](https://arxiv.org/html/2605.17169v1/x1.png)Figure 2:Online causal signal is estimable from agent execution prefixes, supporting required properties for responsible agent\.AUPRC measures how well a monitor identifies failing trajectories before harm materializes\. NeSy monitors substantially outperform random and zero\-shot LLM baselines\.We report preliminary experiments targeting the L2 with detailed implementation details in Appendix[A](https://arxiv.org/html/2605.17169#A1), where online provenance signal is attributed from execution prefix traces to support responsible decision making across multi\-component agentic systems\. We study this through a plug\-in neuro\-symbolic \(NeSy\) monitoring architecture that attaches to agentic systems without modifying their internals\. Raw agent traces are converted into a canonical step\-level representation via a one\-time offline adapter induction, compressed into learned failure\-aligned event abstractions, and scored by monitors ranging from neural sequence models to auditable finite\-state variants without deployment\-time LLM judging\. This design means that any agentic system producing execution logs can be equipped with provenance\-based monitoring capacity, instantiating the computable responsibility\.

Figure[2](https://arxiv.org/html/2605.17169#S5.F2)shows AUPRC results across WebArena\(Zhouet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib18)\), TAU2Bench\(Barreset al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib86)\), SkillsBench\(Liet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib11)\), and TerminalBench\(Merrillet al\.,[2026](https://arxiv.org/html/2605.17169#bib.bib85)\), where the red baseline reflects each benchmark’s positive\-prefix rate under random scoring\. Three findings bear directly on the provenance agenda\. All learned monitors exceed the random baseline by substantial margins, establishing thatPr⁡\[ω∣et,αt:T\]\\Pr\[\\omega\\mid e\_\{t\},\\alpha\_\{t:T\}\]is estimable online and that the quantifiability requirement is tractable at runtime\. Finite\-state variants compress warning behavior into symbolic states legible to human auditors, providing the inspectable causal evidence that traceability requires and that the epistemic positionεpt\\varepsilon^\{t\}\_\{p\}in Definition[4\.2](https://arxiv.org/html/2605.17169#S4.Thmtheorem2)depends on\. Monitors further identify high\-risk prefixes early enough to support intervention before irreversible consequences accumulate, satisfying the interventionability requirement that provenance be produced continuously\.

## 6Who Bears Responsibility in Agentic System

Table 1:WebArena DFA prefixes decomposed into interpretable states as explicit provenance\. Each state reports failure\-risk evidence \(Risk\), supporting\-prefix count \(Eval\), normalized timingt¯/T\\bar\{t\}/T, and representative states for responsibility interpretation, support responsibility assignment or intervention\.StateBehavioral PhaseRiskEvalt¯/T\\bar\{t\}/TRepresentative StateWarning states \(risk≥\\geq0\.34\)q0Early navigation reset0\.8575440\.25click; goto homepageq28Explicit error message0\.548400\.81type \[out of stock…\]q22Repetitive click loop0\.5185950\.40click×\\times6 \(no type\)q12Misaligned search query0\.5106430\.25type \[CMU\]q24External\-search redirect0\.4342760\.40new\_tab; goto google\.com;q1Early scroll\-and\-click0\.3423790\.25click; scroll \[down\]Representative normal states \(risk<<0\.25\)q17Productive backtracking0\.085560\.83go\_back×\\times5q4Credential entry0\.0991390\.67type \[username\]; clickq26Task\-specific search0\.038900\.50type \[color utility\]; clickq8Long\-form text entry0\.122800\.74type \[multi\-sentence msg\]q7Short\-label selection0\.1191110\.75type \[feature\]; clickSection[5](https://arxiv.org/html/2605.17169#S5)establishes that explicit provenance makes causal signal estimable online, but that answers only how much causal contribution a party made\. Populating the full responsibility tensor𝐑​\[p,ω,dk\]\\mathbf\{R\}\[p,\\omega,d\_\{k\}\]requires mapping provenance signals to specific parties, answering not only how much but who bears responsibility\. We illustrate how provenance\-grounded symbolic states can structure this mapping through interpretable examples using a Deterministic Finite Automaton \(DFA\) monitor in Table[1](https://arxiv.org/html/2605.17169#S6.T1)and Appendix[B](https://arxiv.org/html/2605.17169#A2)\.

###### Example 1\(Responsibility Assignment from Provenance in WebArena\)\.

An agent tasked with multi\-step web navigation is monitored online by the DFA from Section[5\.5](https://arxiv.org/html/2605.17169#S5.SS5)\. As shown in Table[1](https://arxiv.org/html/2605.17169#S6.T1), the provenance states identify warning statesq12q\_\{12\}\(misaligned search query, risk0\.5100\.510\) andq24q\_\{24\}\(external\-search redirect, risk0\.4340\.434\) att¯/T=0\.25\\bar\{t\}/T=0\.25and0\.400\.40respectively, well before the task concludes\. Both states surface early boundary violations and their representative trace evidence directly maps responsible components back to accountable parties through𝒫\\mathcal\{P\}\.

Taking these states as provenance evidence,𝐑\\mathbf\{R\}can be partially populated as follows\. Stateq12q\_\{12\}points to the skill developer’s failure to specify retrieval boundaries, contributing to𝐑​\[skill developer,ω,dStandards\]\\mathbf\{R\}\[\\text\{skill developer\},\\omega,d\_\{\\text\{Standards\}\}\]and𝐑​\[skill developer,ω,dPractice\]\\mathbf\{R\}\[\\text\{skill developer\},\\omega,d\_\{\\text\{Practice\}\}\]\. Stateq24q\_\{24\}points to the platform operator’s failure to enforce navigation constraints, contributing to𝐑​\[platform operator,ω,dRegulation\]\\mathbf\{R\}\[\\text\{platform operator\},\\omega,d\_\{\\text\{Regulation\}\}\]and𝐑​\[platform operator,ω,dProfessionalism\]\\mathbf\{R\}\[\\text\{platform operator\},\\omega,d\_\{\\text\{Professionalism\}\}\]\. The agent developer bears weight ondStandardsd\_\{\\text\{Standards\}\}for deploying without compositional verification\. The end user’s entries remain negligible absent prior authorization or risk disclosure\(Weidingeret al\.,[2022](https://arxiv.org/html/2605.17169#bib.bib14)\), and residual responsibility falls toρinst\\rho\_\{\\mathrm\{inst\}\}under Definition[4\.4](https://arxiv.org/html/2605.17169#S4.Thmtheorem4)\. If dimension weightswkw\_\{k\}have been established as part of the responsibility envelope at L3, responsibility shares become further computable and precisely allocated across parties\.

This example demonstrates that provenance\-grounded states make responsibility assignment across deployment\-chain parties tractable, transforming the question of who bears responsibility from an unanswerable subjective concept into a actionable and computable allocation\.

## 7Alternative Views

Provenance requirements impose overhead that constrains capability and slows deployment\.Requiring explicit provenance records across the full deployment chain adds instrumentation and verification costs that favor well\-resourced actors and may slow deployment of beneficial systems\(Anderljunget al\.,[2023](https://arxiv.org/html/2605.17169#bib.bib81)\)\. Our position is that this objection misidentifies the bottleneck\. The constraint on agentic AI deployment is not the absence of provenance infrastructure but the absence of trust\(McKinsey & Company,[2026](https://arxiv.org/html/2605.17169#bib.bib27); Deloitte,[2026](https://arxiv.org/html/2605.17169#bib.bib29)\)\. Research on autonomous vehicles shows that public trust, not technical capability, is the binding constraint on adoption, as cities that prioritize safety and transparency accelerate deployment while those that do not face sustained public resistance regardless of how capable the underlying technology becomes\(Hurst and Sintov,[2022](https://arxiv.org/html/2605.17169#bib.bib82)\)\. Provenance infrastructure does not cap what agentic systems can do; it builds the institutional trust that makes large\-scale delegation of authority viable\.

Distributed responsibility produces irresolvable conflict between parties with incompatible interests and values\.Different actors in the deployment chain hold different commercial, cultural, and epistemic positions, and any responsibility assignment will be contested\. The deeper concern is that no single weighting of normative dimensions in𝐑\\mathbf\{R\}can claim universal legitimacy across communities with genuinely different values\. However, we posit that value pluralism is not a reason to abandon structured accountability but a reason to build accountability structures that are explicit about where value choices are made\(Novelliet al\.,[2024](https://arxiv.org/html/2605.17169#bib.bib42); Wieringa,[2020](https://arxiv.org/html/2605.17169#bib.bib38)\)\. The responsibility tensor𝐑\\mathbf\{R\}is designed precisely for this, as the dimension weightswkw\_\{k\}are not fixed by the framework but determined by domain\-specific governance, making value disagreements legible and contestable rather than hidden inside opaque attribution decisions\. Conflict overwkw\_\{k\}is the mechanism through which pluralistic norms are negotiated and actionable, not evidence that the framework cannot work\(Huet al\.,[2025](https://arxiv.org/html/2605.17169#bib.bib61)\)\.

## 8Conclusion

Agentic AI is already acting in the world, yet the responsibility structures needed to govern it remain absent\. This paper has positioned explicit provenance as the necessary infrastructure for making responsibility computable and actionable across the full agentic lifecycle\. Through formal analysis, a four\-layer agenda, and preliminary experiments, we have demonstrated that responsibility satisfying quantifiability, traceability, and interventionability is both necessary and tractable\. The work ahead spans design, engineering, deployment, and population\-scale experience, and requires sustained engagement with law, ethics, and the social sciences not as adjacent disciplines but as co\-designers of the accountability infrastructure that agentic AI demands\. Only by making responsibility computable and actionable can the field earn the public trust that large\-scale delegation of authority requires\. The technology is already moving faster than the responsibility structures that should govern it, and closing that gap before it becomes irreversible is a shared obligation across the agentic AI ecosystem\.

## References

- \[1\]J\. Achiam, S\. Adler, S\. Agarwal, L\. Ahmad, I\. Akkaya, F\. L\. Aleman, D\. Almeida, J\. Altenschmidt, S\. Altman, S\. Anadkat,et al\.\(2023\)Gpt\-4 technical report\.arXiv preprint arXiv:2303\.08774\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[2\]M\. Anderljung, J\. Barnhart, A\. Korinek, J\. Leung, C\. O’Keefe, J\. Whittlestone, S\. Avin, M\. Brundage, J\. Bullock, D\. Cass\-Beggs, B\. Chang, T\. Collins, T\. Fist, G\. Hadfield, A\. Hayes, L\. Ho, S\. Hooker, E\. Horvitz, N\. Kolt, J\. Schuett, Y\. Shavit, D\. Siddarth, R\. Trager, and K\. Wolf\(2023\)Frontier ai regulation: managing emerging risks to public safety\.External Links:2307\.03718,[Link](https://arxiv.org/abs/2307.03718)Cited by:[§7](https://arxiv.org/html/2605.17169#S7.p1.1)\.
- \[3\]M\. Andriushchenko, A\. Souly, M\. Dziemian, D\. Duenas, M\. Lin, J\. Wang, D\. Hendrycks, A\. Zou, J\. Z\. Kolter, M\. Fredrikson,et al\.AgentHarm: a benchmark for measuring harmfulness of llm agents\.InThe Thirteenth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§4\.1](https://arxiv.org/html/2605.17169#S4.SS1.p2.4)\.
- \[4\]\(2024\)Conformal risk control\.External Links:[Link](https://openreview.net/forum?id=33XGfHLtZg)Cited by:[§5\.3](https://arxiv.org/html/2605.17169#S5.SS3.p1.5)\.
- \[5\]Anthropic\(2026\)Tool use with claude\.Note:Claude API documentationExternal Links:[Link](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[6\]T\. Balke and T\. Eymann\(2008\)The conclusion of contracts by software agents in the eyes of the law\.InProceedings of the 7th international joint conference on Autonomous agents and multiagent systems\-Volume 2,pp\. 771–778\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[7\]V\. Barres, H\. Dong, S\. Ray, X\. Si, and K\. Narasimhan\(2025\)τ2\\tau^\{2\}\-Bench: evaluating conversational agents in a dual\-control environment\.arXiv:2506\.07982\.External Links:2506\.07982,[Document](https://dx.doi.org/10.48550/arXiv.2506.07982),[Link](https://arxiv.org/abs/2506.07982)Cited by:[§5\.5](https://arxiv.org/html/2605.17169#S5.SS5.p2.2)\.
- \[8\]R\. Bommasani, K\. A\. Creel, A\. Kumar, D\. Jurafsky, and P\. S\. Liang\(2022\)Picking on the same person: does algorithmic monoculture lead to outcome homogenization?\.Advances in neural information processing systems35,pp\. 3663–3678\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1),[§5\.4](https://arxiv.org/html/2605.17169#S5.SS4.p1.7)\.
- \[9\]T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. D\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.Advances in neural information processing systems33,pp\. 1877–1901\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[10\]A\. Chan, R\. Salganik, A\. Markelius, C\. Pang, N\. Rajkumar, D\. Krasheninnikov, L\. Langosco, Z\. He, Y\. Duan, M\. Carroll,et al\.\(2023\)Harms from increasingly agentic algorithmic systems\.InProceedings of the 2023 ACM conference on fairness, accountability, and transparency,pp\. 651–666\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p3.1)\.
- \[11\]J\. Cho, K\. Chan, and S\. Adali\(2015\)A survey on trust modeling\.ACM Computing Surveys \(CSUR\)48\(2\),pp\. 1–40\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[12\]J\. Cobbe, M\. Veale, and J\. Singh\(2023\)Understanding accountability in algorithmic supply chains\.InProceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency,pp\. 1186–1197\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1)\.
- \[13\]E\. Commissionet al\.\(2022\)Proposal for a directive of the european parliament and of the council on adapting noncontractual civil liability rules to artificial intelligence \(ai liability directive\)\.European Commission\.External Links:[Link](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022PC0496)Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[14\]A\. Dafoe\(2018\)AI governance: a research agenda\.Governance of AI Program, Future of Humanity Institute, University of Oxford: Oxford, UK1442,pp\. 1443\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1)\.
- \[15\]Deloitte\(2026\)Business and it leaders report ai agents are scaling faster than their guardrails\.External Links:[Link](https://www.deloitte.com/us/en/insights/topics/emerging-technologies/ai-agents-scaling-faster.html)Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p2.1),[§2](https://arxiv.org/html/2605.17169#S2.p2.1),[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§7](https://arxiv.org/html/2605.17169#S7.p1.1)\.
- \[16\]Y\. Dong, R\. Mu, Y\. Zhang, S\. Sun, T\. Zhang, C\. Wu, G\. Jin, Y\. Qi, J\. Hu, J\. Meng,et al\.\(2025\)Safeguarding large language models: a survey\.Artificial intelligence review58\(12\),pp\. 382\.Cited by:[§5\.1](https://arxiv.org/html/2605.17169#S5.SS1.p1.4)\.
- \[17\]F\. Doshi\-Velez, M\. Kortz, R\. Budish, C\. Bavitz, S\. Gershman, D\. O’Brien, K\. Scott, S\. Schieber, J\. Waldo, D\. Weinberger,et al\.\(2017\)Accountability of ai under the law: the role of explanation\.arXiv preprint arXiv:1711\.01134\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§5\.4](https://arxiv.org/html/2605.17169#S5.SS4.p1.7)\.
- \[18\]E\. Ferrara\(2024\)GenAI against humanity: nefarious applications of generative artificial intelligence and large language models\.Journal of Computational Social Science7\(1\),pp\. 549–569\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[19\]I\. Gabriel, A\. Manzini, G\. Keeling, L\. A\. Hendricks, V\. Rieser, H\. Iqbal, N\. Tomašev, I\. Ktena, Z\. Kenton, M\. Rodriguez,et al\.\(2024\)The ethics of advanced ai assistants\.arXiv preprint arXiv:2404\.16244\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1),[§5\.4](https://arxiv.org/html/2605.17169#S5.SS4.p1.7)\.
- \[20\]D\. Ganguli, L\. Lovitt, J\. Kernion, A\. Askell, Y\. Bai, S\. Kadavath, B\. Mann, E\. Perez, N\. Schiefer, K\. Ndousse,et al\.\(2022\)Red teaming language models to reduce harms: methods, scaling behaviors, and lessons learned\.arXiv preprint arXiv:2209\.07858\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[21\]A\. d\. Garcez and L\. C\. Lamb\(2023\)Neurosymbolic ai: the 3 rd wave\.Artificial Intelligence Review56\(11\),pp\. 12387–12406\.Cited by:[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p2.7)\.
- \[22\]A\. Geiger, H\. Lu, T\. Icard, and C\. Potts\(2021\)Causal abstractions of neural networks\.Advances in neural information processing systems34,pp\. 9574–9586\.Cited by:[§5\.1](https://arxiv.org/html/2605.17169#S5.SS1.p1.4)\.
- \[23\]Z\. Guo, Z\. Chen, X\. Nie, J\. Lin, Y\. Zhou, and W\. Zhang\(2026\)Skillprobe: security auditing for emerging agent skill marketplaces via multi\-agent collaboration\.arXiv preprint arXiv:2603\.21019\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2605.17169#S5.SS1.p1.4)\.
- \[24\]I\. Habli, T\. Lawton, and Z\. Porter\(2020\)Artificial intelligence in health care: accountability and safety\.Bulletin of the World Health Organization98\(4\),pp\. 251\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px3.p1.1)\.
- \[25\]S\. Hong, M\. Zhuge, J\. Chen, X\. Zheng, Y\. Cheng, J\. Wang, C\. Zhang, Z\. Wang, S\. K\. S\. Yau, Z\. Lin,et al\.\(2023\)MetaGPT: meta programming for a multi\-agent collaborative framework\.InThe twelfth international conference on learning representations,Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[26\]J\. Hu, Y\. Dong, S\. Ao, Z\. Li, B\. Wang, L\. Singh, G\. Cheng, S\. D\. Ramchurn, and X\. Huang\(2025\)Stop reducing responsibility in llm\-powered multi\-agent systems to local alignment\.External Links:2510\.14008,[Link](https://arxiv.org/abs/2510.14008)Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1),[§7](https://arxiv.org/html/2605.17169#S7.p2.4)\.
- \[27\]J\. HU, Y\. DONG, Z\. DING, and X\. HUANG\(2025\)Enhancing robustness of llm\-driven multi\-agent systems through randomized smoothing\.Chinese Journal of Aeronautics,pp\. 103779\.External Links:ISSN 1000\-9361,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.cja.2025.103779),[Link](https://www.sciencedirect.com/science/article/pii/S1000936125003851)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p1.1)\.
- \[28\]J\. Hu, Y\. Dong, Y\. Sun, and X\. Huang\(2026\-Mar\.\)Tapas are free\! training\-free adaptation of programmatic agents via llm\-guided program synthesis in dynamic environments\.Proceedings of the AAAI Conference on Artificial Intelligence40\(35\),pp\. 29477–29485\.External Links:[Link](https://ojs.aaai.org/index.php/AAAI/article/view/40189),[Document](https://dx.doi.org/10.1609/aaai.v40i35.40189)Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[29\]J\. Hu, X\. Huang, Y\. Sun, Y\. Dong, and X\. Huang\(2026\)Lying with truths: open\-channel multi\-agent collusion for belief manipulation via generative montage\.External Links:2601\.01685,[Link](https://arxiv.org/abs/2601.01685)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[30\]K\. F\. Hurst and N\. D\. Sintov\(2022\)Trusting autonomous vehicles as moral agents improves related policy support\.Frontiers in PsychologyVolume 13 \- 2022\.External Links:[Link](https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2022.976023),[Document](https://dx.doi.org/10.3389/fpsyg.2022.976023),ISSN 1664\-1078Cited by:[§7](https://arxiv.org/html/2605.17169#S7.p1.1)\.
- \[31\]Y\. Jiang, D\. Li, H\. Deng, B\. Ma, X\. Wang, Q\. Wang, and G\. Yu\(2026\)SoK: agentic skills–beyond tool use in llm agents\.arXiv preprint arXiv:2602\.20867\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[32\]T\. Kuntz, A\. Duzan, H\. Zhao, F\. Croce, J\. Z\. Kolter, N\. Flammarion, and M\. AndriushchenkoOS\-harm: a benchmark for measuring safety of computer use agents\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track,Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[33\]M\. H\. Lee, J\. M\. Montgomery, and C\. K\. Lai\(2024\)Large language models portray socially subordinate groups as more homogeneous, consistent with a bias observed in humans\.InProceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency,pp\. 1321–1340\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[34\]B\. Li, P\. Qi, B\. Liu, S\. Di, J\. Liu, J\. Pei, J\. Yi, and B\. Zhou\(2023\)Trustworthy ai: from principles to practices\.ACM Computing Surveys55\(9\),pp\. 1–46\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p2.1)\.
- \[35\]X\. Li, W\. Chen, Y\. Liu, S\. Zheng, X\. Chen, Y\. He, Y\. Li, B\. You, H\. Shen, J\. Sun,et al\.\(2026\)SkillsBench: benchmarking how well agent skills work across diverse tasks\.arXiv preprint arXiv:2602\.12670\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1),[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2605.17169#S5.SS1.p1.4),[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p2.7),[§5\.5](https://arxiv.org/html/2605.17169#S5.SS5.p2.2)\.
- \[36\]P\. Liang, R\. Bommasani, T\. Lee, D\. Tsipras, D\. Soylu, M\. Yasunaga, Y\. Zhang, D\. Narayanan, Y\. Wu, A\. Kumar,et al\.Holistic evaluation of language models\.Transactions on Machine Learning Research\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[37\]H\. Liu, Y\. Wang, W\. Fan, X\. Liu, Y\. Li, S\. Jain, Y\. Liu, A\. Jain, and J\. Tang\(2022\)Trustworthy ai: a computational perspective\.ACM Transactions on Intelligent Systems and Technology14\(1\),pp\. 1–59\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p2.1)\.
- \[38\]S\. Lu, Y\. Wang, L\. Sheng, L\. He, A\. Zheng, and J\. Liang\(2025\)Out\-of\-distribution detection: a task\-oriented survey of recent advances\.ACM Computing Surveys58\(2\),pp\. 1–39\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px3.p1.1)\.
- \[39\]A\. Matthias\(2004\)The responsibility gap: ascribing responsibility for the actions of learning automata\.Ethics and information technology6\(3\),pp\. 175–183\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1),[§4\.2](https://arxiv.org/html/2605.17169#S4.SS2.p2.1)\.
- \[40\]McKinsey & Company\(2025\)The state of ai in 2025: agents, innovation, and transformation\.External Links:[Link](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[41\]McKinsey & Company\(2026\)State of ai trust in 2026: shifting to the agentic era\.External Links:[Link](https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-forward/state-of-ai-trust-in-2026-shifting-to-the-agentic-era)Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p2.1),[§2](https://arxiv.org/html/2605.17169#S2.p2.1),[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§7](https://arxiv.org/html/2605.17169#S7.p1.1)\.
- \[42\]M\. A\. Merrill, A\. G\. Shaw, N\. Carlini, B\. Li, H\. Raj, I\. Bercovich, L\. Shi, J\. Y\. Shin, T\. Walshe, E\. K\. Buchanan,et al\.\(2026\)Terminal\-bench: benchmarking agents on hard, realistic tasks in command line interfaces\.arXiv preprint arXiv:2601\.11868\.Cited by:[§5\.5](https://arxiv.org/html/2605.17169#S5.SS5.p2.2)\.
- \[43\]J\. Mok, I\. Kim, S\. Park, and S\. Yoon\(2025\)Exploring the potential of llms as personalized assistants: dataset, evaluation, and analysis\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 10212–10239\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[44\]C\. Novelli, M\. Taddeo, and L\. Floridi\(2024\)Accountability in artificial intelligence: what it is and how it works\.Ai & Society39\(4\),pp\. 1871–1882\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§5\.3](https://arxiv.org/html/2605.17169#S5.SS3.p1.5),[§7](https://arxiv.org/html/2605.17169#S7.p2.4)\.
- \[45\]V\. Ojewale, H\. Suresh, and S\. Venkatasubramanian\(2026\)Audit trails for accountability in large language models\.arXiv preprint arXiv:2601\.20727\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p3.1),[§4\.1](https://arxiv.org/html/2605.17169#S4.SS1.p2.4),[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p1.5)\.
- \[46\]M\. Oliver\(2021\)Contracting by artificial intelligence: open offers, unilateral mistakes, and why algorithms are not agents\.ANU Journal of Law and Technology2\(1\),pp\. 45–87\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[47\]OpenAI\(2025\)Introducing operator\.External Links:[Link](https://openai.com/index/introducing-operator/)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[48\]OpenAI\(2025\)New tools for building agents\.External Links:[Link](https://openai.com/index/new-tools-for-building-agents/)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[49\]OpenClaw\(2026\)ClawHub: skill directory for openclaw\.External Links:[Link](https://github.com/openclaw/clawhub)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[50\]OpenClaw\(2026\)OpenClaw: personal ai assistant\.External Links:[Link](https://openclaw.ai/)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[51\]J\. S\. Park, J\. O’Brien, C\. J\. Cai, M\. R\. Morris, P\. Liang, and M\. S\. Bernstein\(2023\)Generative agents: interactive simulacra of human behavior\.InProceedings of the 36th annual acm symposium on user interface software and technology,pp\. 1–22\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[52\]J\. Peters, D\. Janzing, and B\. Scholkopf\(2017\)Elements of causal inference: foundations and learning algorithms\.MIT press\.Cited by:[§5\.1](https://arxiv.org/html/2605.17169#S5.SS1.p1.4)\.
- \[53\]Z\. Porter, P\. Ryan, P\. Morgan, J\. Al\-Qaddoumi, B\. Twomey, P\. Noordhof, J\. McDermid, and I\. Habli\(2025\)Unravelling responsibility for ai\.Journal of Responsible Technology,pp\. 100124\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1)\.
- \[54\]PwC\(2025\)PwC’s ai agent survey\.External Links:[Link](https://www.pwc.com/us/en/tech-effect/ai-analytics/ai-agent-survey.html)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p2.1)\.
- \[55\]I\. D\. Raji, A\. Smart, R\. N\. White, M\. Mitchell, T\. Gebru, B\. Hutchinson, J\. Smith\-Loud, D\. Theron, and P\. Barnes\(2020\)Closing the ai accountability gap: defining an end\-to\-end framework for internal algorithmic auditing\.InProceedings of the 2020 conference on fairness, accountability, and transparency,pp\. 33–44\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[56\]Y\. Ruan, H\. Dong, A\. Wang, S\. Pitis, Y\. Zhou, J\. Ba, Y\. Dubois, C\. J\. Maddison, and T\. HashimotoIdentifying the risks of lm agents with an lm\-emulated sandbox\.InThe Twelfth International Conference on Learning Representations,Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[57\]C\. Rudin\(2019\)Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead\.Nature machine intelligence1\(5\),pp\. 206–215\.Cited by:[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p2.7)\.
- \[58\]T\. Schick, J\. Dwivedi\-Yu, R\. Dessì, R\. Raileanu, M\. Lomeli, E\. Hambro, L\. Zettlemoyer, N\. Cancedda, and T\. Scialom\(2023\)Toolformer: language models can teach themselves to use tools\.Advances in neural information processing systems36,pp\. 68539–68551\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p1.1)\.
- \[59\]L\. Staufer, K\. Feng, K\. Wei, L\. Bailey, Y\. Duan, M\. Yang, A\. P\. Ozisik, S\. Casper, and N\. Kolt\(2026\)The 2025 ai agent index: documenting technical and safety features of deployed agentic ai systems\.arXiv preprint arXiv:2602\.17753\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[60\]H\. Sun, A\. Hüyük, D\. Jarrett, and M\. van der Schaar\(2023\)Accountability in offline reinforcement learning: explaining decisions with a corpus of examples\.Advances in Neural Information Processing Systems36,pp\. 3143–3172\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1)\.
- \[61\]H\. Touvron, L\. Martin, K\. Stone, P\. Albert, A\. Almahairi, Y\. Babaei, N\. Bashlykov, S\. Batra, P\. Bhargava, S\. Bhosale,et al\.\(2023\)Llama 2: open foundation and fine\-tuned chat models\.arXiv preprint arXiv:2307\.09288\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[62\]S\. Vallor and T\. Vierkant\(2024\)Find the gap: ai, responsible agency and vulnerability\.Minds and Machines34\(3\),pp\. 20\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1)\.
- \[63\]N\. A\. Vincent, I\. Van de Poel, and J\. Van Den Hoven\(2011\)Moral responsibility: beyond free will and determinism\.Springer Science & Business Media\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1)\.
- \[64\]D\. C\. Vladeck\(2014\)Machines without principals: liability rules and artificial intelligence\.Wash\. L\. Rev\.89,pp\. 117\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2605.17169#S3.p2.1)\.
- \[65\]L\. Wang, C\. Ma, X\. Feng, Z\. Zhang, H\. Yang, J\. Zhang, Z\. Chen, J\. Tang, X\. Chen, Y\. Lin,et al\.\(2024\)A survey on large language model based autonomous agents\.Frontiers of Computer Science18\(6\),pp\. 186345\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[66\]Y\. Wang, H\. Chen, Q\. Heng, W\. Hou, Y\. Fan, Z\. Wu, J\. Wang, M\. Savvides, T\. Shinozaki, B\. Raj, B\. Schiele, and X\. Xie\(2023\)FreeMatch: self\-adaptive thresholding for semi\-supervised learning\.External Links:[Link](https://openreview.net/forum?id=PDrUPTXJI_A)Cited by:[§5\.3](https://arxiv.org/html/2605.17169#S5.SS3.p1.5)\.
- \[67\]L\. Weidinger, J\. Uesato, M\. Rauh, C\. Griffin, P\. Huang, J\. Mellor, A\. Glaese, M\. Cheng, B\. Balle, A\. Kasirzadeh,et al\.\(2022\)Taxonomy of risks posed by language models\.Proceedings of the ACM Conference on Fairness, Accountability, and Transparency,pp\. 214–229\.Cited by:[§6](https://arxiv.org/html/2605.17169#S6.p2.10)\.
- \[68\]M\. Wieringa\(2020\)What to account for when accounting for algorithms: a systematic literature review on algorithmic accountability\.InProceedings of the 2020 conference on fairness, accountability, and transparency,pp\. 1–18\.Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p3.1),[§7](https://arxiv.org/html/2605.17169#S7.p2.4)\.
- \[69\]Q\. Wu, G\. Bansal, J\. Zhang, Y\. Wu, B\. Li, E\. Zhu, L\. Jiang, X\. Zhang, S\. Zhang, J\. Liu,et al\.\(2024\)Autogen: enabling next\-gen llm applications via multi\-agent conversations\.InFirst conference on language modeling,Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[70\]Z\. Xi, W\. Chen, X\. Guo, W\. He, Y\. Ding, B\. Hong, M\. Zhang, J\. Wang, S\. Jin, E\. Zhou,et al\.\(2025\)The rise and potential of large language model based agents: a survey\.Science China Information Sciences68\(2\),pp\. 121101\.Cited by:[§1](https://arxiv.org/html/2605.17169#S1.p1.1)\.
- \[71\]F\. F\. Xu, Y\. Song, B\. Li, Y\. Tang, K\. Jain, M\. Bao, Z\. Z\. Wang, X\. Zhou, Z\. Guo, M\. Cao, M\. Yang, H\. Y\. Lu, A\. Martin, Z\. Su, L\. M\. Maben, R\. Mehta, W\. Chi, L\. K\. Jang, Y\. Xie, S\. Zhou, and G\. Neubig\(2026\)TheAgentCompany: benchmarking LLM agents on consequential real world tasks\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track,External Links:[Link](https://openreview.net/forum?id=LZnKNApvhG)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p1.1)\.
- \[72\]S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao\(2023\)ReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p1.1)\.
- \[73\]T\. Yin, R\. Raab, M\. Liu, and Y\. Liu\(2023\)Long\-term fairness with unknown dynamics\.Advances in Neural Information Processing Systems36,pp\. 55110–55139\.Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[74\]T\. Yuan, Z\. He, L\. Dong, Y\. Wang, R\. Zhao, T\. Xia, L\. Xu, B\. Zhou, F\. Li, Z\. Zhang, R\. Wang, and G\. Liu\(2024\-11\)R\-judge: benchmarking safety risk awareness for LLM agents\.InFindings of the Association for Computational Linguistics: EMNLP 2024,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 1467–1490\.External Links:[Link](https://aclanthology.org/2024.findings-emnlp.79/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-emnlp.79)Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px3.p1.1)\.
- \[75\]Q\. Zhan, Z\. Liang, Z\. Ying, and D\. Kang\(2024\-08\)InjecAgent: benchmarking indirect prompt injections in tool\-integrated large language model agents\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 10471–10506\.External Links:[Link](https://aclanthology.org/2024.findings-acl.624/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.624)Cited by:[§3\.1](https://arxiv.org/html/2605.17169#S3.SS1.SSS0.Px2.p1.1)\.
- \[76\]G\. Zhang, J\. Wang, J\. Chen, W\. Zhou, K\. Wang, and S\. YAN\(2026\)AgenTracer: who is inducing failure in the LLM agentic systems?\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=l05DseqvuD)Cited by:[§4\.1](https://arxiv.org/html/2605.17169#S4.SS1.p2.4),[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p2.7)\.
- \[77\]S\. Zhang, M\. Yin, J\. Zhang, J\. Liu, Z\. Han, J\. Zhang, B\. Li, C\. Wang, H\. Wang, Y\. Chen, and Q\. Wu\(2025\-13–19 Jul\)Which agent causes task failures and when? On automated failure attribution of LLM multi\-agent systems\.InProceedings of the 42nd International Conference on Machine LearningThe Eleventh International Conference on Learning RepresentationsThe Twelfth International Conference on Learning Representations,A\. Singh, M\. Fazel, D\. Hsu, S\. Lacoste\-Julien, F\. Berkenkamp, T\. Maharaj, K\. Wagstaff, and J\. Zhu \(Eds\.\),Proceedings of Machine Learning Research, Vol\.267,pp\. 76583–76599\.External Links:[Link](https://proceedings.mlr.press/v267/zhang25cq.html)Cited by:[§4\.1](https://arxiv.org/html/2605.17169#S4.SS1.p2.4),[§5\.2](https://arxiv.org/html/2605.17169#S5.SS2.p2.7)\.
- \[78\]S\. Zhou, F\. F\. Xu, H\. Zhu, X\. Zhou, R\. Lo, A\. Sridhar, X\. Cheng, T\. Ou, Y\. Bisk, D\. Fried, U\. Alon, and G\. Neubig\(2024\)WebArena: a realistic web environment for building autonomous agents\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=oKn9c6ytLx)Cited by:[§2](https://arxiv.org/html/2605.17169#S2.p1.1),[§5\.5](https://arxiv.org/html/2605.17169#S5.SS5.p2.2)\.

## Appendix AImplementation Details of Neuro\-Symbolic Trial

This appendix describes the implementation of the neuro\-symbolic monitoring trial reported in Section[5\.5](https://arxiv.org/html/2605.17169#S5.SS5)\. The trial is a preliminary instantiation of the L2 engineering agenda designed to demonstrate the feasibility of the research directions for responsible agentic system proposed in this paper\. It is not intended as a standalone system contribution; its purpose is to establish that online provenance signals satisfying quantifiability, traceability, and interventionability are producible from heterogeneous agent execution traces\.

#### Prefix and Warning Label\.

A trajectory is an ordered sequence of execution steps recorded during an agent’s task attempt\. A prefix is the partial observation available to the monitor up to a given step during online execution, representing what has been observed so far without access to future steps\. Each trajectory is associated with a binary outcome indicating task success or failure as determined by a task\-specific verifier\. Given a fixed warning horizon, a prefix is labeled a positive warning target if and only if the trajectory fails and fewer than a fixed number of steps remain before termination; all other prefixes are labeled negative\. This labeling captures the steps immediately preceding failure, where failure\-relevant provenance signals are most concentrated\.

#### Trace view\.

The monitor does not consume raw logs directly\. Each benchmark trace is first mapped into a fixed StepView record with fields for metadata, observation, action, tool, arguments, result, and status\. The adapter is induced once from training traces and then frozen, so validation and test traces are processed by deterministic code rather than by deployment\-time LLM calls\. Validation and test traces are not used during adapter induction; the LLM acts only as a design\-time parser proposer, not as a runtime evaluator\.

#### Event abstraction\.

Each StepView record is serialized in a fixed field order and encoded with a training\-only TF\-IDF vocabulary\. A small differentiable projection maps the encoded step into a learned event alphabet\. This alphabet is optimized for the prefix\-warning objective, so the symbols are intended to capture recurring failure\-relevant evidence rather than manually named task states\.

#### Monitor variants\.

The same learned event stream is used by four online monitor variants that span different points on the neural–symbolic tradeoff\. The Gated Recurrent Unit \(GRU\) and Transformer variants act as flexible neural prefix scorers\. The soft Finite State Machine \(FSM\) variant keeps a distribution over latent finite states during neural deployment, exposing a structured intermediate representation\. The Deterministic Finite Automaton \(DFA\) variant is extracted post\-hoc from hard event assignments and serves as an audit diagnostic, testing whether the learned behavior can be compressed into compact, risk\-separating symbolic states that are legible to human auditors and suitable as causal evidence in responsibility attribution\.

#### Evaluation metric\.

For every partial trajectory prefix, the monitor emits a risk score for near\-term failure under a fixed warning horizonHH\. Prefixes from failed trajectories inside the finalHHsteps are labeled positive; successful prefixes and earlier failed\-trajectory prefixes are labeled negative\. Area Under the Precision\-Recall Curve \(AUPRC\) is used as the primary ranking metric because warning targets are sparse and positive\-prefix rates vary substantially across benchmarks\. AUPRC measures how well a monitor ranks high\-risk prefixes above low\-risk ones using continuous risk scores, with the random baseline equal to each benchmark’s positive\-prefix rate\. A monitor that substantially exceeds this baseline demonstrates that causal signal is recoverable from execution prefixes online, directly supporting the requirement of Proposition[3\.1](https://arxiv.org/html/2605.17169#S3.Thmtheorem1)\.

#### Baselines\.

Three comparison conditions are included\. The random baseline reflects the positive\-prefix rate of each benchmark and represents the performance of a monitor with no predictive signal\. The zero\-shot Large Language Model \(LLM\) baseline applies a frontier language model as a full\-prefix judge without any task\-specific training, representing the upper bound of deployment\-time LLM judging under matched evaluation conditions\. The supervised neural controls use the same StepView representations and prefix labels as the learned monitors but without the discrete event abstraction layer, isolating the contribution of failure\-aligned symbol learning\. All conditions share the same prefix\-labeling protocol and held\-out evaluation splits to ensure comparability\. The finite\-state results should be read as an interpretability diagnostic rather than as the only deployable form of the method\.

## Appendix BExtended Provenance Example on Dialogue Agent Responsibility Attribution

To demonstrate that provenance\-grounded symbolic states are not specific to web navigation environments, Table[2](https://arxiv.org/html/2605.17169#A2.T2)reports DFA state behavioral provenance on TAU2Bench, a tool\-using dialogue benchmark involving customer service agents\. The extracted automaton yields 20 states; Table[2](https://arxiv.org/html/2605.17169#A2.T2)reports the three trusted warning states and six representative normal states, with the remaining states excluded due to insufficient calibration support\. Each trusted state is characterized by its risk score, the number of prefixes routed to it, its normalized timingt¯/T\\bar\{t\}/T, and a representative execution step that anchors its behavioral interpretation\.

Three trusted warning states surface coherent failure\-precursor patterns\. Stateq1q\_\{1\}\(risk 0\.357,t¯/T\\bar\{t\}/T= 0\.57\) captures mid\-dialogue grounded lookup fan\-out, where repeatedget\_detailsor reservation queries after the task is underway indicate difficulty resolving the customer request\. Stateq19q\_\{19\}\(risk 0\.337,t¯/T\\bar\{t\}/T= 0\.59\) captures out\-of\-policy handoff, where a special\-case request such as post\-booking insurance is refused or transferred as indicated byrespond \[insurance not allowed\]\. Stateq15q\_\{15\}\(risk 0\.218,t¯/T\\bar\{t\}/T= 0\.78\) captures late unresolved troubleshooting, where refund\-policy or service failures such asrespond \[refund/MMS fails\]remain open near trajectory end\. Normal states correspond to routine task phases such as initial greeting and identity lookup \(q0q\_\{0\}, risk 0\.031\), billing remediation \(q16q\_\{16\}, risk 0\.082\), and transactional updates \(q14q\_\{14\}, risk 0\.060\)\. Compared to WebArena, the TAU2Bench automaton is more concentrated, withq0q\_\{0\}alone routing 16,754 prefixes, reflecting the more structured nature of dialogue\-based task execution\. These results show that the neuro\-symbolic monitoring architecture surfaces interpretable provenance states across heterogeneous agentic environments, and that the representative trace evidence within each state directly supports mapping responsible components back to accountable parties through𝒫\\mathcal\{P\}, satisfying the traceability requirement that explicit provenance must provide inspectable causal evidence legible to human auditors\.

Table 2:TAU2Bench DFA prefixes decomposed into interpretable states as explicit provenance\. Each state reports failure\-risk evidence \(Risk\), supporting\-prefix count \(Eval\), normalized timingt¯/T\\bar\{t\}/T, and representative trace evidence for responsibility interpretation\. Trusted warning states are listed first to support responsibility assignment or intervention\.StatePhaseRiskEvalt¯/T\\bar\{t\}/TRepresentative StepTrusted warning statesq1Grounded lookup fan\-out0\.35739490\.57get\_details / reservationq19Out\-of\-policy handoff0\.337310\.59respond \[insurance not allowed\]q15Late unresolved troubleshooting0\.2184560\.78respond \[refund/MMS fails\]Representative trusted normal statesq0Greeting / identity lookup0\.031167540\.25respond; customer lookupq11Policy summary / confirmation0\.13729920\.72respond \[summary\]q12Info collection / guidance0\.11614710\.72get\_order; respondq16Billing remediation0\.0826070\.68check/make paymentq14Transactional update0\.0604110\.81send\_certificate; check\_simq5Mid\-course telecom diagnosis0\.018420\.38toggle\_airplane\_mode