Weekly signal

Human–agent trust moved from an academic problem to an operational requirement this week as standards, toolchains, and empirical security research converged on three practical fixes: verifiable signed receipts for every agent action, stronger retrieval-time enforcement for agent memory (revocation/TLS), and richer in-path observability/guardrails that builders can turn on today. These steps aim to shift trust from agent prose to independently verifiable evidence and deployment controls.

What changed

1. A working compliance profile for cryptographically signed action receipts (an Internet-Draft, published 21 Sep 2026) formalized payload, signature, hash-chain and cross-agent binding semantics so auditors and incident responders can verify who did what and when without trusting a vendor’s UI. This draft defines counterparty bindings, envelope digests, anchor/witness policies and verifier rules.

2. Practical reference implementations and governance proxies made receipts testable in the field: Attested Intelligence republished its Evaluate / AGA demo with figures recomputed 21 Sep 2026 (release 3.6.0), showing offline verification of signed evidence bundles, deny/permit receipts, and a tiered verification model usable in pilots.

3. Agent frameworks and libraries are shipping receipt-first designs and “trust-first” defaults. Reactive Agents documents signed run receipts, deterministic flight-recorders, and replayable traces that builders can adopt to make each run auditable.

4. Two empirical security papers in September quantified memory-driven trust failures: “The Memory Trust Gap” (capability-dependent stale-memory harms) and “Revoked but Still Authoritative” (five memory backends failing to enforce revocation by default). Both show agents often act on stale or revoked facts and propose retrieval-time guards.

5. Vendor and threat signals keep pressure on operational trust: UiPath’s AI Trust Layer and centralized guardrails show vendor moves toward tenant-level enforcement, while GTIG/Mandiant reporting reiterates supply-chain and agentic credential-harvest threats that directly erode human trust if agents surface compromised artifacts.

What to do with it

• Adopt signed receipts and verifiers in pilots: export evidence bundles and verify them offline; pin gateway keys out of band.
• Treat memory as a cache: add TTLs, write-time validation, and a retrieval guard that hides revoked records until revalidated. Run the published memory-guard between agent and store.
• Enable in-path governance proxies / agent tracing (OpenTelemetry spans, signed receipts) and test end-to-end replay/forensic workflows before production.
• Harden supply chain and tool-call surface: least-privilege tool policies, signed tool fingerprints, CI vetting, and incident playbooks (include EU AI Act reporting steps).