Observability for Delegated Execution in Agentic AI Systems

Standard audit logs and execution traces cannot reliably determine which actions were performed under a specific delegation in agentic AI systems, according to new research. The ambiguity arises because identical observables can correspond to multiple, incompatible delegation assignments, undermining forensic and security reviews. The finding, detailed in a paper posted to arXiv on 8 June 2026, identifies a structural gap in how LLM-based agentic systems are monitored. The authors state that delegation-scoped execution is not identifiable from standard observables, noting that audit logs and execution traces can be identical under multiple incompatible delegation assignments [1][2]. The problem is especially acute when agents dynamically select tools, vary execution sequences across runs for the same instruction, and spawn cooperating sub-agents, which fragments and interleaves traces [2]. Existing audit, tracing, and security schemas lack the semantics to reconstruct what actions occurred under a given delegation across heterogeneous systems, the paper argues [1][2]. While individual actions are authorized and logged, the causal structure alone is structurally underdetermined for delegation-scoped reconstruction [2]. The research focuses on delegation-scoped attribution and access or share footprint reconstruction, explicitly excluding intent inference or reasoning reconstruction [1][2]. To address the gap, the authors propose an agent-aware observability substrate built around a lightweight gateway and a common information model that binds delegation context at execution time [1][2]. The design enables reliable cross-tool delegation-scoped reconstruction and supports direct forensic queries without relying on heuristic time-window correlation, a technique commonly used when precise causal links are missing [1][2]. The work lands as agentic AI architectures—where models chain tool calls and spawn sub-tasks—are being deployed in enterprise settings that require auditable delegation chains. The paper’s approach does not require changes to underlying models but instead introduces an infrastructure layer that captures delegation context as actions occur [2]. The authors position the substrate as a complement to existing logging and identity systems, not a replacement [1][2].