The Untracked Agent Problem
Your AI agent just sent a customer an offer, adjusted a bid, or promised a refund. Now answer one question: which decision path produced that action, on whose authority, and where is the record?
An API log is not an accountability system.
The untracked agent is an identity and provenance gap. The tools to close it now exist in production.
92%
of surveyed leaders lacked full agent-identity visibility
<40ms
Uber’s reported P99 token-exchange overhead
The question your stack cannot answer
If the honest answer is “we have the API log and nothing else,” you are running what most companies are running: agents with superpowers and no accountability.
The problem is architectural, not careless. Every identity system was built for two actors: people and workloads with service credentials. An AI agent is neither. It is an entity authorized to act for someone else, often through other agents. The acting chain gets dropped at every hop, so the tool call looks like “some service called an API” even when the real actor was a specific agent acting for a specific person.
Uber’s security engineering team describes the failure pattern precisely: an on-call engineer asks one agent to investigate an alert, that agent delegates to another, and the second agent opens a pull request. The PR shows that a bot made the change. The human who set the chain in motion, and the path between them, are gone from the record.
Swap the engineering nouns for marketing ones. A lifecycle agent decides a customer qualifies for a retention discount, then hands off to a messaging agent that sends the offer. The CRM logs a call from “marketing-automation-service.” Which agent decided, based on what data, authorized by which campaign owner? Nothing in the stack can say.
Liability does not wait for your logs
While records stay incomplete, the accountability regime has become concrete. A German court held Google liable for false statements in AI Overviews, a narrow ruling with a broad implication: when an AI system speaks or acts and someone is harmed, a company answers for it, not “the algorithm.” The Air Canada precedent set the same direction for customer-facing bots.
The money is moving too. In EY-consortium survey data reported in March 2026, 64% of companies above $1 billion in revenue attributed more than $1 million in 2025 losses to AI system failures, while 80% documented risky agent behaviors including unauthorized system access and data exposure. The FBI’s 2025 Internet Crime Report recorded more than 22,000 complaints and over $893 million in losses involving AI.
Now put those facts together with discovery. A customer claims your agent misled them. Opposing counsel subpoenas the decision records. What you produce is an API log showing the end state, no intermediate reasoning, no acting chain, and no proof of what the agent was authorized to do. You cannot replay the decision. Missing provenance is not a defense posture. It is a settlement calculator.
Marketing is spending into this exact gap. Gartner’s 2026 CMO Spend Survey says CMOs allocate 15.3% of their budgets to AI, but only 30% say they are ready to scale AI capabilities. The budget is moving faster than the evidence file.
Uber published the blueprint, and killed the cost excuse
What makes 2026 different is that the fix is no longer theoretical. Uber’s post reads as one of the clearest public blueprints for agent provenance in production, and three design choices matter to anyone buying or building agents.
First, every agent gets a real identity. An agent registry records which agent is authorized to run on which workload, anchored in cryptographically verifiable credentials. An unregistered agent cannot quietly borrow another agent’s authority.
Second, the acting chain travels with every request. Each hop carries a short-lived, scoped token that embeds the full lineage: this human asked this agent, which delegated to that agent, which is now calling this tool. Downstream systems see every participant instead of only the immediate caller.
Third, it is fast. Uber reports the token exchange behind the system runs below 40 milliseconds at the 99th percentile across thousands of internal agents. End-to-end provenance is compatible with production speed. The “observability later, velocity now” tradeoff is a prioritization choice.
The provenance layer is being built around you
Provenance is not only something you build internally. It is becoming something the outside world demands from your agents.
Start with payments. Google’s Agent Payments Protocol uses cryptographically signed mandates as verifiable proof of what a user instructed an agent to do. Mastercard’s Verifiable Intent extends the same idea, creating a tamper-resistant record of user authorization before the agent acts.
The same shift is happening at the network edge. Cloudflare’s Web Bot Auth lets agents sign requests so sites can verify who is knocking, replacing brittle IP-based guesswork. An unidentifiable agent is becoming an unserved agent: blocked at the door, declined at checkout, or rejected by the API.
NIST and IETF identity work turns these patterns into portable plumbing. Every serious infrastructure player is converging on the same requirement: agents must be identifiable, their authority verifiable, and their actions attributable.
What a marketing team should actually do
You do not need Uber’s security team. You need five decisions.
Inventory every system, yours or a vendor’s, that can take an action in your name: send, spend, price, promise, book, or refund. Then make provenance a procurement question. Ask to see the audit trail for one real decision, not a marketing page about “full observability.”
Inventory acting agents
List every system that can send, spend, price, promise, book, or refund.
Procure for provenance
Ask vendors to replay one real decision from human intent to final action.
Log decisions
Persist the initiator, policy, context, agent, tool, reviewer, and final action.
Scope autonomy
Keep unprovable decisions in low-stakes lanes until traceability earns authority.
Track the standards
Require vendors to support verifiable identity as signed mandates and agents spread.
Source notes
Evidence behind the refresh
The June version had the right instinct but thin evidence. This version drops the invented claims, keeps the liability stakes, and links the infrastructure now closing the gap.
Uber Engineering
Solving the Identity Crisis for AI Agents
Agent registries, actor chains, scoped tokens, and sub-40ms P99 token exchange across thousands of internal agents.
Gartner
The 2026 CMO Spend Survey
CMOs allocate 15.3% of budgets to AI, while only 30% say they are ready to scale AI capabilities.
Google Cloud / AP2
Agent Payments Protocol
Cryptographically signed mandates make user intent verifiable when an agent transacts.
Mastercard
Verifiable Intent
A tamper-resistant record of what a user authorized before an agent acted.
Cloudflare
Signed Agents and Web Bot Auth
Cryptographically verified agent identity at the network edge, replacing brittle IP-based assumptions.
Cybersecurity Insiders
2026 CISO AI Risk Report
A survey of 235 large-enterprise security leaders found 92% lacked full visibility into their AI agent identities.
FAQs
What is AI agent provenance?+
Provenance is the verifiable record of an agent’s actions and authority: which human or system initiated a task, which agents handled it, what each was authorized to do, and what decision path produced the final action. It preserves the full chain of delegation instead of recording only the last API call.
Who is liable when an AI agent makes a mistake?+
The company that deployed it is usually the party that must answer. Courts have been consistent that a chatbot or agent is not a responsible legal entity. Missing records do not shift liability; they make it harder to prove diligence and defend the decision.
Does building agent provenance slow systems down?+
Uber’s published production metrics show the token exchange behind its identity and lineage system running below 40 milliseconds at the 99th percentile across thousands of agents. Provenance is an engineering choice, not an unavoidable speed penalty.
What should a marketing team log for an AI agent?+
Log the initiator, agent identity, delegation chain, inputs, policy or threshold applied, tool calls, final action, reviewer, and any correction. A record that captures only the outcome or API endpoint is telemetry, not provenance.
How do I evaluate an agent vendor?+
Ask the vendor to replay one real decision from human intent to final action. Look for cryptographic identity, scoped authority, portable delegation, model-change notices, and a record your legal or operations team can inspect without asking the vendor to reconstruct it from memory.
Autonomy is not the advantage.
Proof is.