Enforcement & signed intent

Agents lose the plot. A context window fills and truncates, a session expires, work hands off to a fresh agent, a tool swap wipes the running state. The conversation that held what the agent was doing evaporates - and a model asked to remember will reconstruct a plausible story that may never have been true.

The signed record does not evaporate. When an agent loses context, it reads its records and recovers what it was required and authorized to do - byte-for-byte, signed, not a summary of a conversation that no longer exists. The same record names the principalAgentId accountable for the work and the requestedBy party that asked for it. If the laptop you ordered arrives two weeks later, the agent does not have to remember why - it reads the record it created when it placed the order.

This is signed intent, and it is the reason to plug AGLedger in today even before you need a gate: it makes long-running and delegated agents more reliable now, not just auditable later. And you do not build it - the agent reports, the notary signs. The free Developer Edition is enough to start.

After-the-fact logging captures the action. It cannot capture what the agent meant to do, or whose authority it claimed - because by the time you ask, the agent has lost the context and will reconstruct a plausible story. Intent and authority are only honest when they are signed at the moment they are real: before the action. Capture them afterward and you have recorded half the story and made up the other half.

That is why a record carries more than the action. It names what was intended, and who stands behind it - signed before the consequential step, not narrated after it. The authority is the principal's; the signature is the notary's.

A notary matters most when the work actually stops to use it. Put a gate in the path of consequential automated actions - buying hardware, provisioning a user, moving funds - and the record becomes a precondition of the work, not a hope about it. The gate is yours: your own policy engine, or an off-the-shelf agent-governance toolkit. AGLedger never blocks your systems; it holds the signed record the gate checks. The gate intercepts the consequential tool call and refuses it until a valid record exists. The rejection is not a dead end; it is a directive the agent can act on.

If the gate only checks that a record ID field is filled in, an agent under pressure to complete its task will invent one that satisfies the requirement. The gate has to confirm the record actually exists, against the AGLedger API, before it trusts it. It is a single read - on the order of 50 to 200 milliseconds, negligible against model inference - and it is the difference between a control and a checkbox. This is also why weaker agents are not a reason against the pattern: an agent that fabricates an ID fails closed, because the gate validates rather than trusts.

When the gate cannot reach AGLedger to validate a record, it has to choose: block the action (fail-closed, safer) or allow it (fail-open, more available). The reference implementation fails closed - the consequential step waits rather than proceeding unrecorded. “Fail-closed” is a policy you set at your own gate, not something AGLedger does to you. Configure it to your risk tolerance, but the default is the one that keeps the trail complete.

AGLedger does not decide whether your agent may act. The gate enforces the policy; your principal, or your rules engine, renders the verdict; AGLedger holds the signed record of both the intent and the decision. Where the action crosses a delegation boundary and someone other than the doer must accept or reject the delivery, that verdict path is the Gate. The enforcement point is how you make reaching it mandatory.

The same record then serves three readers. The agent reads it to recover what it was told to do. The operator reads it to see what the fleet intended and did. The auditor reads it to prove it - verifying the cryptography offline, without taking anyone's word. The signing the agent never needed is what the auditor relies on.