Technical Summary: Responsible Agentic AI Requires Explicit Provenance

1. Problem Statement

The rapid proliferation of Agentic AI—systems capable of autonomous planning, tool use, and multi-step execution in real-world environments—has outpaced the development of accountability structures. While individual components (e.g., skills, tools, models) may pass safety audits, their composition within an agent often leads to emergent harms, regulatory violations, and diffused responsibility.

Current "trustworthy AI" approaches rely on component-level benchmarking and post-hoc auditing. These methods fail because:

• Compositional Risk: Safety properties verified in isolation do not survive interaction.
• Diffuse Accountability: Harm emerges from long-horizon trajectories and distributed causal chains that no single actor designed or controls end-to-end.
• Lack of Computability: Responsibility remains a subjective, unenforced concept because there is no explicit, traceable record (provenance) linking specific harms to specific parties and causal contributions.

The paper argues that without explicit provenance across the full agentic lifecycle, responsibility cannot be made computable, actionable, or enforceable.

2. Methodology and Formalization

The authors propose a framework grounded in explicit provenance to make responsibility computable. This involves formalizing the necessary evidence and structural layers required to assign responsibility.

2.1 Core Definitions

• Agentic Trajectory ($\tau$): A finite sequence of environment states and joint agent actions.
• Causal Contribution ($\kappa$): A measure of a party's causal influence on a harm event $\omega$. It is defined as the difference in the probability of harm occurring with the party's decisions versus a counterfactual trajectory where those decisions are neutralized:
  $$\kappa(p, \omega, \tau) = \Pr[\omega | \tau] - \Pr[\omega | \tau_{-p}]$$
• Epistemic Position ($\varepsilon$): A measure of what a party knew or should have reasonably foreseen given their role and available information at time $t$.
• Computable Responsibility ($\rho$): A function assigning a responsibility weight to each party $p$ for harm $\omega$, satisfying:
  1. Proportionality: $\rho \propto \kappa \cdot \mathbb{1}[\text{foreseeable}]$.
  2. Completeness: The sum of individual responsibilities plus residual institutional responsibility equals 1.
  3. Non-evasion: Parties cannot escape responsibility for foreseeable contributions via system complexity.
• Responsibility Tensor ($R$): A multi-dimensional structure $R \in [0, 1]^{|P| \times |\Omega| \times |D|}$ that encodes responsibility across parties, harm events, and socio-technical dimensions (e.g., standards, regulation, professionalism).

2.2 The Four-Layer Lifecycle Agenda

To operationalize these definitions, the paper outlines a four-layer research agenda:

1. L1 (Design): Establishing a causal dependency graph ($G$) representing parties, models, and skills before deployment. This ensures the system is designed to produce the necessary provenance.
2. L2 (Engineering): Implementing online trajectory monitoring to estimate trajectory risk ($\Pr[\omega | e_t, \alpha_{t:T}]$) in real-time. This layer must produce structured, failure-aligned execution records to support both traceability (retrospective) and interventionability (prospective).
3. L3 (Deployment): Translating technical provenance into normative judgments. This involves defining "responsibility envelopes," dimension weights ($w_k$), and incident response plans to map causal signals to specific parties.
4. L4 (Experience): Addressing cumulative harms (e.g., autonomy erosion, bias amplification) that occur over long horizons without crossing single-step thresholds. This requires population-scale monitoring of user choice sets and belief divergence.

3. Key Results and Experiments

The paper presents preliminary experimental validation for the L2 (Engineering) layer, specifically focusing on the estimability of causal signals online.

• Experimental Setup: The authors utilized a plug-in Neuro-Symbolic (NeSy) monitoring architecture attached to agentic systems. This architecture converts raw agent traces into canonical step-level representations and scores them using various monitors (Neural sequence models, Finite-State Machines, Transformers, GRUs) without modifying the agent's internals.
• Datasets: Experiments were conducted across four benchmarks: WebArena, TAU2Bench, SkillsBench, and TerminalBench.
• Metric: Area Under the Precision-Recall Curve (AUPRC) was used to measure how well monitors identify failing trajectories before harm materializes.
• Findings:
  • Learned monitors significantly outperformed random baselines and zero-shot LLM baselines.
  • Finite-State variants successfully compressed warning behaviors into symbolic states legible to human auditors, providing the inspectable evidence required for traceability.
  • Monitors identified high-risk prefixes early enough to support intervention before irreversible consequences accumulated, validating the interventionability requirement.
• Case Study: The authors demonstrated how these symbolic states (e.g., "misaligned search query," "external-search redirect") can be mapped back to specific deployment-chain parties (e.g., skill developers, platform operators) to populate the Responsibility Tensor, transforming subjective blame into a computable allocation.

4. Significance and Claims

The paper positions explicit provenance not as a discretionary refinement but as a necessary condition for responsible Agentic AI.

• Structural Necessity: The authors argue that the current "trust deficit" in AI adoption is structural, not merely technical. Responsibility gaps exist because no party produces the quantifiable, traceable, and interventionable records needed to assign blame when harm emerges from compositional behavior.
• Shift in Paradigm: The work moves the field from "benchmark-driven evaluation" (which assesses capability in isolation) to "provenance-grounded accountability" (which assesses responsibility across the full lifecycle).
• Actionability: By formalizing responsibility as a computable function based on causal contribution and foreseeability, the paper claims to make the concept of responsibility actionable for regulators, developers, and institutions.
• Institutional Trust: The authors contend that the bottleneck for Agentic AI adoption is not a lack of capability, but a lack of trust. Explicit provenance infrastructure is presented as the mechanism to build the institutional trust required for large-scale delegation of authority.

The paper concludes that closing the gap between rapid technological advancement and responsibility structures is a shared obligation, requiring sustained collaboration between computer science, law, ethics, and social sciences to design the accountability infrastructure Agentic AI demands.