Every agentic AI governance stack has five layers, and most implementation effort goes into one of them. Business Objective, Agent Capability, Permission Boundary, Behavioural Audit, Human Oversight — organisations past pilot stage can usually name all five. Fewer can explain what actually distinguishes the third layer from the fourth.
CISOs already own the vocabulary for the Permission Boundary layer. It is access governance under a new name: least privilege, scoped credentials, role-based authorisation, applied to a non-human actor instead of a human one. Most agentic AI programmes that have reached production have built this layer reasonably well, because it maps directly onto identity and access management practice that already exists.
Behavioural Audit tends to get built later, and usually inherits from transaction logging: record the action, the timestamp, the actor. That establishes what happened. It does not establish whether the record of what happened can be independently verified, rather than taken on the agent's own account of itself.
What "Audit Trail Ambiguity" Actually Means
The Cloud Security Alliance's framework for agentic AI identity and access management names this gap directly: audit trail ambiguity. A log can show that an agent authenticated, called a tool and returned an answer, without establishing who authorised the step, on what information, and whether the outcome the log describes is the outcome that actually occurred. For institutions supervised under FINMA Guidance 08/2024, this is not an abstract distinction — the guidance expects documented, testable evidence that a deployment is monitored and its decisions traceable, not confirmation that outputs were usually correct.
Consider a Permission Boundary working exactly as designed. An agent operating in a payment approval workflow holds scoped credentials: it can draft a payment request, gather supporting documentation and generate a justification, but it cannot authorise the transfer itself. A human reviewer signs off before funds move. Every access control fires correctly.
What the reviewer is actually evaluating, in this configuration, is evidence the agent produced about itself. The justification, the supporting documentation, the account of why the payment is reasonable — none of it originates outside the agent's own output. A four-eyes control assumes the second pair of eyes has something independent to examine. When the only evidence available is the agent's own narrative, independence is the part of the control that is missing, even though every permission was configured correctly.
From Logging to Provenance
A 2026 survey of evidence tracing in LLM agent systems makes the same point from the research side. Final-answer accuracy — did the agent reach the right outcome — is a different question from process-level accountability: which evidence supported each claim, whether a tool call was actually necessary, whether the reasoning an agent reports matches what its execution actually did.
Final-answer accuracy evaluates only the endpoint of an execution; it does not explain how an output was produced, which evidence supported each claim, whether tool calls were justified, whether memory items were relevant and trustworthy, or which execution step caused a failure.
— Wang et al., "From Agent Traces to Trust," 2026
The researchers frame this as a provenance problem rather than a logging problem: agent actions connected through typed relations — support, contradict, derive, depend-on — so a claim can be checked against what actually generated it, not just recorded beside it. That is a materially different engineering requirement than adding fields to a log schema. It is the difference between a Behavioural Audit layer that records what happened and one that can establish whether what it recorded is true.
Where This Sits in the Stack
This is why the AI Control Failure Taxonomy treats Audit Evasion as its own category, distinct from Permission Drift or Scope Breach. A system can have correctly scoped permissions and a complete transaction log, and still fail here. The failure sits in a different place: nobody can establish, after the fact, whether the record of what the agent did would survive being checked.
Closing that distance does not require a sixth layer in the stack. It requires treating Behavioural Audit as a control with its own requirements, separate from Permission Boundary and heavier than transaction logging: independent evidence attribution, typed provenance relations connecting a claim to what actually generated it, and a way to check an agent's account of its own action against what the execution trace shows. That is the current job of Behavioural Monitoring in the Behavioral Governance Framework, and in most implementations it is the least built-out of the three pillars.