What the Agent Rested On
An agent's action is only as good as what it rested on. When that changes, know every action and record to revisit, and stop the next one.
The problem. An agent's log records what it did, not the model version, the data it read or the person who approved its mandate. A tool inventory shows what is installed today, not what ran then. Neither follows an action into the records other departments built on it.
What this demo shows. On generated years Fabric missed none of the 596 actions and records that changes to an agent's basis reached; a search of the agent log missed 331 and the tool inventory 455. Both let 18 actions through that should have been held. On GitHub's real advisories, 390 affect agent tool packages, 209 on MCP in 2026.
How it works:
- Every part of the basis. Mandate and approver, model version, tools at versions and data read: each action cites them, so a change to any one finds it.
- Into other departments. Goods receipts, release decisions, quarter reports and deployments resting on an agent's action are found with it.
- Checked before it runs. The agent's next action is held when what it would rest on no longer stands, as known the day before.
The honest part. The company and its agents are fictional and generated. The real record is advisories on packages named as agent tools, not deployments: no real agent's actions were read.
Fabric tells whoever runs AI agents, the day a model, tool, mandate or source changes, which actions to review, which should not have happened, and which next one to stop.
An AI agent acts under a mandate a person granted, on a model version, with tools at versions and the data it reads. That is its basis, as a credential is a person's. Fabric records every action citing its basis, and every record in other departments resting on the action. When any part of the basis changes, every action and record resting on it is found the same day with a verdict, and the agent's next action is checked before it runs.
A generated year of a fictional company's six AI agents, with planted changes and an answer key; confirmed on GitHub's real advisories on the tools agents use.
1. Each change in one generated year
Review: the action may be wrong. Refuted: it should not have happened. Greyed: a change no action rested on, so nothing is raised.
2. Against the agent log and the tool inventory
3. The real record: advisories on the tools agents use
What this does not show
- The company, its agents, mandates, people and records are fictional and generated; the verdicts are judged against the generator's answer key.
- The real record is GitHub's reviewed advisory database as saved on 2026-10-16. A package counts as an agent tool by name: "mcp" as a part of its name, the listed agent frameworks, or the LiteLLM gateway, which may admit a package that is not an agent tool or miss one not listed. An advisory is not a deployment: no real agent's actions were read.
- Fabric's reading of the real record agreed with a plain count over the same files.