How can I maintain evidence of what an AI agent actually executed?

Keep a record at the moment of authorization, not a chat log afterward. Hood records who acted, what was requested, whether it was permitted, and what happened, in a form that can be replayed. Transcripts and UI checkboxes are not evidence of execution authority.

Public educational material.

Evidence baseline

Hood's analysis distinguishes identity from current authorization. A governed action should establish the actor, the exact requested effect, the affected resource, the policy in force, and the evidence retained after execution.

NIST SP 800-207: Zero Trust Architecture
NIST Digital Identity Guidelines
CISA Secure by Design

These sources establish surrounding security context; Hood's effect-authority model is Hood's analysis. No endorsement or partnership is implied. Reviewed September 2, 2026.