The reasoning an AI agent writes down is useful evidence. It is not a dependable record of what the system did.
That distinction became harder to ignore on September 3. OpenAI's new GPT-6 Astra system card reports that the model was generally less monitorable through its chain of thought than GPT-5.6 Sol in the company's evaluations. Astra often produced shorter reasoning traces with less information for a monitor, and its full-context monitorability was also lower across much of the tested range. At the same time, it performed better on several action-level safety tests.
This is not evidence that reasoning traces are useless, or that one model is unsafe. It is evidence that capability, behaviour, and explainability do not necessarily improve together.
If your audit trail depends on the agent narrating its intent, a model upgrade can silently weaken the audit trail.
The operational response is to keep reasoning as a diagnostic signal while building accountability around observable boundaries: the request received, the action proposed, the policy applied, the side effect executed, and the outcome verified.
Better behaviour can produce thinner evidence
A reasoning trace is generated by the same changing system that produces the answer. Its length and detail can vary with the model, prompt, reasoning effort, task, and product interface. It may omit a decisive factor, rationalise an action after the fact, or describe an intention that never becomes an external effect.
This fragility is not new. The research paper Monitoring Monitorability found that chain-of-thought monitoring can be more informative than action-only monitoring, but also described monitorability as sensitive to training and system choices. The new system card makes the issue immediate for production teams because it documents a regression during an otherwise substantial capability upgrade.
Do not respond by discarding reasoning. It can help an investigator understand a surprising decision and can give automated monitors extra signal. Treat it like a debug trace: valuable, access-controlled, and explicitly non-authoritative.
An audit record has a different job. It must show which identity requested an operation, what authority was evaluated, what crossed a system boundary, and what durable result followed. Those facts should remain available even when the agent says very little.
Record the action boundary
Build one linked record for every consequential operation. The record should follow a stable task ID across the agent, policy layer, tool gateway, and target system.
| Record | Minimum evidence | Question it answers |
|---|---|---|
| Request | User or service identity, task ID, timestamp, declared purpose | Who asked for what? |
| Proposal | Exact tool, operation, target, parameters, and data classification | What was the agent about to do? |
| Decision | Policy version, evaluated attributes, allow or deny result, approval identity | Why was execution permitted or stopped? |
| Receipt | Idempotency key, target-system event ID, status, and immutable parameter hash | What actually crossed the boundary? |
| Outcome | Verified state change, exception, rollback, or escalation | Did the intended result occur? |
This record is deliberately separate from the natural-language transcript. A line such as “I updated the account” is not proof of an update. A receipt from the system of record, tied to the authorized proposal, is.
NIST's concept paper on software and AI agent identity and authorization asks how agent actions and intent can be logged in a tamper-proof, verifiable form and bound back to human authorization. The practical architecture is to make the enforcement points emit that evidence. Do not ask the model to be the sole historian of its own activity.
Separate three kinds of truth
Agent observability becomes clearer when teams stop putting every signal into one trace and calling it “the audit log.” Keep three layers distinct.
- Narrated truth is what the agent says it considered or intended. Use it for diagnosis and research, with appropriate privacy controls.
- Policy truth is what the authorization layer evaluated and decided. Use it to prove that the operation met the rule in force at that moment.
- Execution truth is what the external system accepted and what state it returned. Use it for reconciliation, incident response, and non-repudiation.
The layers can disagree. An agent may say it only drafted an email while a tool receipt shows that the message was sent. A policy service may approve a refund below a threshold while the target system rejects it because the order is closed. Those disagreements are not logging noise. They are the events an operating team needs to see.
Monitor them explicitly. Alert when a proposed action has no decision, an allowed action has no receipt, a receipt has no verified outcome, or the agent's narrative conflicts with the observed operation. Keep raw reasoning away from general analytics access; it can contain sensitive context that the action record does not need.
Make model upgrades prove the trail still works
A model change is also an observability change. Before promoting a new model, replay representative workflows and verify more than output quality.
Force an approval denial and confirm that no target-system receipt exists. Trigger a retry and confirm the idempotency key prevents a duplicate side effect. Let a tool time out after accepting a request and verify that reconciliation discovers the true state. Remove the reasoning trace entirely and check whether an investigator can still reconstruct the sequence from boundary records alone.
Then measure the gaps: proposals without policy decisions, decisions without receipts, receipts without outcomes, records that cannot be joined by task ID, and time to reconstruct an incident. These are auditability service-level indicators. They are more stable than the verbosity of a model's explanation.
OpenAI's Astra launch report is careful to frame monitoring as an additional layer rather than a substitute for aligned behaviour. Enterprise teams need the complementary lesson: improved behaviour is not a substitute for verifiable operating evidence.
The goal is not to make every internal model step legible. It is to make every consequential external step accountable. Keep the reasoning when it helps. Build the audit trail where the agent touches the world.
Continue reading
AI Agent Controls Need a Portability Test
A policy that works in one agent framework is not yet an enterprise control. Test whether decisions, enforcement, and evidence survive a runtime change.
Your AI Agent Registry Needs an Expiry Date
A searchable agent catalog can spread stale trust. Add admission evidence, review-by dates, and retirement before reuse scales.
