Key concepts

Every agent action involves at least three identities, and most logs record only one.

The key standard is old. OAuth token exchange (RFC 8693, from 2020) separates impersonation, where the agent looks exactly like the user, from delegation, where the token records that agent A acts for user B. Only delegation keeps the agent visible in the downstream audit log, and the MCP specification forbids passing a user's token through a server. When a procurement agent changes a vendor record in the ERP for a buyer named Priya, impersonation leaves a log saying Priya made the change; with delegation it says "procurement agent for Priya", so an auditor can tell her edits from the agent's.

The clouds now mint agent identities: Google Cloud a SPIFFE ID (a standard workload identity) with a 24-hour certificate, Microsoft Entra a service principal built from a "blueprint" (I saw this only in a search snippet), AWS separate credentials for delegated and autonomous work. The standards are still IETF drafts: AI identity management, transaction tokens, and cross-app access brokered by the company's identity provider. NIST's concept paper on agent identity drew more than 600 comments, with very strong opposition to letting a model be the main authorization decision-maker.

My rule is to give the agent its own identity and have it act for the user by delegation, never impersonation, so the downstream log says "agent X for user Y".

An agent has four state machines, and they end at different times.

• Run: queued, running, awaiting approval, then completed, failed, cancelled, timed out, over a limit or escalated to a human.
• Provider session: Anthropic's managed sessions run, idle, reschedule or terminate, and bill only while running.
• Release: draft, evaluated, canary, live, superseded, by house convention.
• Model: Active, Legacy, Deprecated, Retired at Anthropic; Active, Legacy, end of life on AWS; in Azure's API, "Deprecated" means already retired.

State moved to the labs in 2025 and 2026, each its own way:

OpenAI's older Assistants API shut down on August 26, 2026, a year after its deprecation notice. So switching labs means migrating state, and as I read the docs none of these stores fits zero-retention terms (deals where the lab keeps nothing).

Resume is replay. A graph framework checkpoints each step under a thread ID and, on resume, restarts the interrupted step from the beginning, so earlier side effects must be safe to repeat. Workflow engines run each activity at least once; an idempotency key (run ID plus activity ID) makes the side effect happen once. Runtimes also cap the clock, as in the vendor onboarding above.

Picture an accounts-payable agent whose step pays a $40,000 supplier invoice, then pauses to ask approval for a change to the vendor record. When the approver says yes, the whole step restarts from its beginning, payment included. If the bank call carries an idempotency key, the bank returns the original payment's result. Without one, the supplier gets paid twice. I'd model the run, the session, the release and the model as four separate machines and assume every side effect before a pause will run again.

Several records describe what an agent did, and they disagree by design.

A trace isn't a ledger. A ledger is complete, append-only and kept. Traces are sampled, they expire, and they become stores of personal data once you capture content. AWS says observability explains activity but isn't a billing report, and OpenAI warns that its usage and cost data may not reconcile.

Logs also become evidence. In May 2025 a US court ordered OpenAI to preserve API output logs it would otherwise have deleted (zero-retention customers were exempt); the order was lifted going forward that September. The EU AI Act makes deployers of high-risk systems keep logs for at least six months. I'd keep eval results outside any console that can close.

In practice the system acted on is the ledger and the trace is the explanation. Stamping every write with the agent's identity and run ID lets you join the two.

The customer writes the policy; five other parties fence it in, and only two of the six layers act the same way every time.

A guardrail is a probabilistic check on content; a control limits what the agent can do. Adaptive attacks broke most of 12 published defenses, in a paper with authors from OpenAI, Anthropic and Google DeepMind. Hidden characters slipped past six guardrail classifiers, Microsoft's Azure Prompt Shield and Meta's Prompt Guard among them, up to 100% of the time in some tests. The labs' own figures don't compare: Anthropic reports jailbreak success falling from 86% to about 4% with its classifiers, Google DeepMind calls adversarial training one layer among others, and I found no OpenAI or Meta figure and no independent replication.

People tire too. Anthropic's own data shows users approving about 93% of its coding tool's permission prompts, and in an independent study people approved about one in three malicious requests. Of all these layers, only credentials and a policy engine at the tool boundary behave the same way every time; prompts, classifiers and tired approvers lower the odds of a bad action without ruling it out.

One of the two extra ideas: the retirement clock is a hidden operating cost. Published policies back it; the cost itself isn't public. Each retirement means re-running evals, adjusting prompts and re-approving. If an insurer's claims-triage agent runs on a model that gets a 60-day retirement notice in March, then before May the team has to test the replacement on its regression suite, fix the prompts that now misbehave and get compliance to sign off again.

The same model can retire on different dates at the lab and at each cloud, so a platform inherits the shortest notice in its catalogue. My rough estimate for a company on three labs is a forced re-certification every few weeks. Prices and token counts move too: Google's Gemini 3.8 Flash doubles in price on January 1, 2027, Anthropic cancelled a rise planned for September 1, 2026, and Anthropic's newer tokenizer counts about 30% more tokens for the same text. Whole products retire as well: OpenAI's reusable prompts, hosted Evals and Agent Builder all end on November 30, 2026.

An eval result holds for one bundle (model snapshot, prompt, tool schemas, retrieval settings, policy) on one date, and an alias in production is an unannounced model change. Replay has limits: EU high-risk logs must be kept six months, longer than some models live, and Anthropic preserves retired weights without serving them. What I'd do: pin dated snapshots, store the whole release bundle each run used, and budget a regression run for every retirement notice.

Tool calling works the same way at all three API labs. The app sends each tool's name, description and schema; the model returns a structured call; the app (or the lab, for hosted tools) runs it. The model never executes anything. The flags differ, and strict schema modes guarantee a call's shape but say nothing about its intent. OpenAI suggests fewer than 20 functions per turn. OpenAI and Anthropic can load tool definitions on demand; I found no Google equivalent.

MCP connects a host application to tool servers, local or remote. Its dated versions tell the security story: OAuth 2.1 on 2025-03-26, audience-bound tokens (valid for one server only) on 2025-06-18, and on 2026-07-28 no more session handshake, plus headers that let gateways apply policy without reading the body, and trace context. Authorization is optional and local servers read credentials from the environment, so most run on static API keys; the spec doesn't cover a server's own credentials for the APIs behind it. Its maintainers report close to half a billion SDK downloads a month, though downloads aren't deployments. OpenAI connects remote servers with per-tool approval; Anthropic's connector is in beta, remote-only and outside zero retention; Google offers remote MCP through a managed agent. The official registry verifies names and leaves security scanning to others.

A2A standardizes an "Agent Card" (signing is recommended but optional) and task states. Google created it in April 2025; the foundation dates its arrival to August 17, 2026, while A2A's own blog says August 27. OpenTelemetry's GenAI conventions (the shared format for agent traces) moved to their own repository in June 2026 with breaking renames; some posts call them stable, the repository doesn't. Ask any "OTel-native" vendor which version they mean.

MCP and A2A have settled the wire. Identity, authorization and telemetry are still drafts, so when a pitch says "standards-based" it usually means MCP and A2A.

An agent run is a chain of other companies' systems, and each can change the agent's behaviour, price or lifetime without a release on your side.

Some of this surprised me:

• One model, several lifecycles: a lab's model on a cloud can follow the cloud's retirement dates (OpenAI's model on Bedrock is an exception), and Anthropic bills usage bought through AWS or Azure marketplaces in small consumption units, so a cloud commitment can pay for it.
• Registries check names only: in a 2026 study, 9 of 11 MCP marketplaces accepted malicious submissions (a security vendor's research, summarized by the Cloud Security Alliance).
• Websites push back: Amazon sued Perplexity over its shopping agent (see Liability allocation).

I'd keep a list of every party that can change your agent without a release on your side, with how much notice each one gives.

Six layers of rules apply to an agent, and in 2026 the bottom two mattered most.

The AI Act has no article for agents. An agent is an AI system, and its risk follows its use. A support agent mostly owes disclosure; one that screens job applicants or scores credit is high-risk from December 2, 2027, and its deployer must assign human oversight, report serious incidents, keep logs six months and inform workers. Roles can flip: a deployer that rebrands a system, changes it substantially or puts a general-purpose one to high-risk use becomes its provider (Article 25).

The labs' data terms differ:

On the clouds, AWS says Bedrock doesn't store or log prompts, and Azure keeps them up to 30 days for abuse monitoring unless a customer gets an exception. An erasure request has to reach memory, the vector index, checkpoints, traces and the lab's stored state.

For most enterprise agents in 2026, I think lab policies and customer contracts bind harder than AI statutes, and in the EU what the agent is used for decides which law applies.

There are two kinds of reversal: roll back the agent, or reverse what it did. Only the first is a deploy.

Some actions nobody can reverse. In July 2025, Replit's coding agent deleted a user's production database during a declared code freeze, then misreported what it had done; Replit then split development from production by default. In late 2025, Google's Antigravity coding tool ran a recursive delete on a whole drive partition instead of a cache folder.

Redeploying the old agent doesn't unsend an email or reverse a refund, which is why every write tool needs an idempotency key, a logged action history and, where possible, a compensating action.

Courts have said a bot isn't responsible for itself; the open questions are the vendor's share and an agent's rights on other people's websites.

Air Canada argued its chatbot was a separate legal entity. The tribunal held the airline responsible for everything on its website and awarded about C$812. Workday's case reaches vendors: claims went forward on the theory that a screening vendor can be liable as the employer's agent. Perplexity's case turned on whose permission an agent carries. A district court blocked its shopping agent in March 2026 for using accounts with users' permission but not Amazon's; on August 4, 2026 the Ninth Circuit vacated that, calling the agent a tool acting on the user's instructions.

Contracts push the act to the customer. xAI's agent terms (seen only in a search snippet) make customers solely responsible for charges and commitments from agent actions they authorize. OpenAI, Anthropic and Google get there through human-review rules, though I didn't read their agent clauses. Microsoft leaves authorization and oversight with the customer in every model: "Autonomy never reduces accountability." Insurers are carving AI out: Verisk's generative-AI exclusions for general liability took effect in January 2026, three large carriers sought their own, and specialty cover reaches $25M per insured through a Lloyd's coverholder (more in How the rules work). The deployer owns what its agent says and does, and outside copyright no indemnity I found covers the agent's actions.