Responsible Agentic AI Requires Explicit Provenance¶

🕒 Published (v1): 2026-05-16 21:56 UTC · Source: Arxiv · link

Why this paper was selected

Explicit provenance as foundation for responsible autonomous agentic AI deployment

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Responsible deployment of agentic AI requires explicit provenance — quantifiable, traceable, and interventionable causal records — because harm in multi-agent pipelines emerges from compositional trajectories that no per-component audit can reconstruct. The paper formalizes this through a causal attribution function $\kappa$, an epistemic position $\varepsilon^t_p$, and a responsibility tensor $R \in [0,1]^{|P|\times|\Omega|\times|D|}$. It argues that without provenance as structural infrastructure, responsibility is subjective and unenforceable regardless of benchmark evaluation quality.

Problem¶

Agentic AI systems compose individually audited components (foundation models, third-party skills, tools) into long-horizon action loops that produce emergent harms untraceable to any single component. Existing trustworthy AI frameworks are designed around per-component audits and produce post-hoc records too coarse for causal attribution, leaving responsibility diffuse across developers, platform operators, and skill maintainers. No current framework makes responsibility computable or actionable at deployment time.

Method¶

The paper is a position/framework paper organized around four axes:

Why (Section 3): Identifies eight sociotechnical dimensions (law, morality, ethics, standards, regulation, values, practice, professionalism) across which the absence of quantifiability, traceability, or interventionability leaves responsibility unresolvable.
What (Section 4): Formalizes provenance requirements. An agentic trajectory $\tau = (e_0, \alpha_0, e_1, \alpha_1, \ldots, e_T)$ over environment states $E$ and joint actions. The causal contribution of party $p$ to harm $\omega$ is: $$\kappa(p, \omega, \tau) = \Pr[\omega \mid \tau] - \Pr[\omega \mid \tau_{-p}]$$ where $\tau_{-p}$ is a counterfactual trajectory with $p$'s decisions neutralized. Epistemic position $\varepsilon^t_p = (I^t_p, C^t_p)$ encodes available information and foreseeable harms at time $t$. The responsibility assignment function $\rho(p, \omega) \propto \kappa(p, \omega, \tau) \cdot \mathbf{1}[\omega \in C^t_p]$ must satisfy proportionality, completeness (residual assigned to an institutional layer $\rho_\text{inst}$), and non-evasion. The full structure is the responsibility tensor $R[p, \omega, d_k]$ with weighted aggregation $\rho(p, \omega) = \sum_k w_k R[p, \omega, d_k]$.
How (Section 5): Four sequentially dependent lifecycle layers — L1 (Design: causal dependency graph $G=(V,E)$ across parties, models, skills), L2 (Engineering: online trajectory monitors estimating $\Pr[\omega \mid e_t, \alpha_{t:T}]$ before irreversible harm; compositional verification $\Delta\kappa$ when new component $x_\text{new}$ is added), L3 (Deployment: normative translation of $\kappa$ and $\varepsilon^t_p$ into a populated $R$, specifying responsibility envelopes and $w_k$), L4 (Experience: population-scale trajectory tracking for gradual harms like autonomy erosion and bias amplification).
Who (Section 6, truncated): Applies the responsibility tensor to a concrete incident to show how obligations are distributed.

Preliminary experiments demonstrate that causal contribution is estimable online from execution prefixes across heterogeneous agent environments.

Key Contributions¶

Formal characterization of three structural properties (quantifiability, traceability, interventionability) that responsible agentic systems must satisfy
Causal attribution function $\kappa$ grounded in counterfactual trajectory interventions
Responsibility tensor $R \in [0,1]^{|P|\times|\Omega|\times|D|}$ as a computable, multi-dimensional allocation structure over deployment-chain parties
Deployment Readiness Condition (Definition 5.1) specifying five pre-deployment requirements including compositional verification and responsibility envelopes
Identification of the "responsibility gap": why per-component auditing structurally fails for compositional agentic systems
Neuro-symbolic online monitors as a tractable direction for real-time $\Pr[\omega \mid e_t, \alpha_{t:T}]$ estimation

Results¶

Preliminary experiments show causal contribution $\kappa$ is estimable online from execution prefixes before irreversible harm accumulates (full details truncated in provided text)
Cited empirical backdrop (not the paper's own experiments): indirect prompt injection achieves 47% attack rate against GPT-4 across 17 tool-integrated systems; over 68% of sandbox scenarios exhibit potential real-world agent failures; over 90% of high-popularity ClawHub skills fail security review; individually valid skills introduce composition risks that reduce task performance
McKinsey survey: 23% of respondents scaling agentic AI, 39% experimenting; PwC: 79% of senior executives report agentic AI adoption

Limitations¶

$\kappa$ is a theoretical anchor, not a directly observable quantity; practical approximation depends on execution trace quality and counterfactual replay fidelity
The paper is a position/framework paper with only "preliminary" experiments; no full empirical validation of the responsibility tensor is provided
Dimension weights $w_k$ specification for the responsibility tensor is declared an open research direction with no proposed solution
L4 (population-scale provenance for gradual harms) is the least developed layer; the counterfactual "how beliefs would differ without the system" is stated as out of scope for L1–L3
Formalisms assume a bounded deployment-chain dictionary $P$ that may be difficult to enumerate in open skill marketplaces like ClawHub

Relevance to Harnesses / Meta-Harnesses¶

This paper directly addresses the accountability infrastructure that meta-harnesses — systems orchestrating pipelines of agents, tools, and skills — must produce. The four lifecycle layers (L1–L4) map precisely onto the design, engineering, deployment, and operational concerns of a harness: L1's multilevel dependency graph $G$ is essentially the harness topology; L2's compositional verification ($\Delta\kappa$ on component addition) is a runtime governance hook a harness must enforce; L3's responsibility envelopes define the contract between a meta-harness and its constituent agents. The paper's argument that per-component auditing is structurally insufficient — because emergent harm lives at the trajectory level — is a direct indictment of harness designs that treat agent outputs as isolated and uncorrelated. For practitioners building meta-harnesses, the Deployment Readiness Condition (Definition 5.1) offers a concrete checklist of what provenance infrastructure the harness itself must maintain.