What is an agent execution boundary?

The problem it answers

AI agents now wire funds, change records, bind coverage and grant access. They do it at machine speed, around the clock, on your authority.

Ask where your evidence comes from. The log, the summary, the status that says done. The agent wrote them, or a tool that only watches the agent did. That is the agent's own account. It is useful. It cannot testify.

When one gets it wrong, nobody will ask what the agent did. They will ask who let it.

How it works

1. The agent asks. Before it acts, it sends the proposed action to the boundary: which agent, what action, what target, which exact arguments.
2. The boundary answers. Allow means cleared. Deny means not cleared, and the no is signed too. Escalate means ask a person.
3. The answer is recorded by something other than the agent. The receipt binds the agent, action, target and exact arguments that were evaluated.

TrustGate returns a signed allow, deny or escalate decision before the action runs, for actions that go through it. A signed decision shows what was cleared. It is as strong as the paths you route through it.

Unknown, never success

A clearance to land is not a landing. What TrustGate can show is the decision, made before the action ran.

An outcome we cannot confirm is reported as unknown, never as success. TrustGate reports 'could not check' separately from 'checked and found nothing'.

What it is not

• Not a model guardrail. It does not filter what a model says or takes in.
• Not observability. It does not replace your logs or traces.
• Not identity and access management. It does not decide who may open a system.
• Not a certificate. It does not certify compliance or give a legal or audit opinion.
• Not a lock. Signatures prove and detect. They do not prevent.
• Not a detector of every failure.

When you do not need this

If your own logs already settle the question for your auditor, keep them. A boundary matters when someone will ask for evidence that the agent was cleared and the only witness is the agent.

5 questions to ask any vendor

1. Who writes the record: the agent, a tool that watches the agent, or something else?
2. Is the answer given before the action runs, or reported after?
3. What does the record bind: which agent, which action, which target, which exact arguments?
4. When the result cannot be confirmed, is it reported as success, as failure, or as unknown?
5. Does the product keep 'could not check' apart from 'checked and found nothing'?

Why this is moving up the agenda

California bars the defense that the AI acted on its own. Civil Code section 1714.46(b), in force since January 1, 2026, says it “it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff.” This is the statute's own text, not legal advice.

The UK Information Commissioner's Office writes that agents “are not and should not be considered as legal entities, even if organisations using agentic AI may seek to blame it for errors.”

Gartner predicts that by 2030, 80% of Global 500 companies will contractually make their CIO (or CAIO) the “Evidence Custodian” for AI accountability, and that insurers, not regulators, will drive AI governance.

54% of organizations have no defined approach to limit AI agent access, or rely on predefined human access, according to a Gartner survey of 297 cybersecurity leaders in the second quarter of 2026.

None of this says TrustGate makes anyone compliant or removes liability. It is the climate in which the question gets asked.