Once software can act across tools and time, trust can no longer be represented by a final answer alone. A result may look correct while the path that produced it was unauthorized, stale, duplicated, unrecoverable or impossible to verify.
Across the current stack, different systems are already solving fragments of this problem. OpenAI's Agents SDK exposes agent loops, handoffs, sessions, human intervention, guardrails and tracing. The A2A protocol models work as stateful tasks with lifecycle states, timestamps, history and artifacts. OpenTelemetry propagates context so distributed traces can preserve causal relationships across services. Temporal treats recovery after crashes and outages as an execution guarantee. Sigstore binds software artifacts to identity, digests, timestamps and auditable verification evidence.
The pieces exist. The missing part is a common verification model that connects them around one action trajectory.
Correctness is a trajectory property.
A final output is only one observation at the end of a path. For an agent that changes external state, we also need to know who acted, what was true before the action, whether the action was allowed in that phase, what changed, what caused it, what happened during failure, and what evidence survived afterward.
That distinction matters because individually valid actions can still compose into an invalid system. A refund endpoint can be correct while a retry duplicates money movement. A production write can be technically successful while happening before approval. A trace can show what happened without proving the business invariant that should have held.
Claim map
Modern agent runtimes expose orchestration, guardrails, state/session handling, human intervention and tracing as first-class primitives. Verified fact · high confidence
Agent interoperability standards model work as stateful tasks with lifecycle states, timestamps, history and artifacts. Verified fact · high confidence
Distributed observability uses propagated context to reconstruct causal relationships across service boundaries. Verified fact · high confidence
Recovery from crashes and outages is a distinct execution property that can be engineered independently of model quality. Verified fact · high confidence
Artifact provenance can be bound to identity, digest, timestamp and auditable verification evidence. Verified fact · high confidence
Agent trust benefits from an integrated model of state, causality, phase, transition, time, recovery, verification and evidence. RESONANCE inference · medium-high confidence
The missing layer is not a missing product.
There is already plenty of trust infrastructure. Identity systems authenticate actors. Policy engines authorize resources. Agent SDKs expose guardrails and approvals. A2A gives tasks explicit lifecycle state. Tracing systems reconstruct execution. Durable runtimes recover workflows. Signing systems attest artifacts.
The hard problem is that these guarantees often live in separate systems. An operator may be able to answer every question individually and still be unable to prove that all the answers describe the same causal path.
The RESONANCE Trust Graph
We propose a compact framework for reasoning about action correctness. This is a RESONANCE model, not an established industry standard.
State
An action cannot be evaluated without knowing the state against which it was valid. "Refund payment" means something different before capture, after settlement, during a dispute or after a prior refund.
Causality
Chronological adjacency is not enough. OpenTelemetry's context-propagation model is a useful systems precedent: causal context must travel across boundaries if we want to reconstruct the path rather than merely collect isolated events.
Phase
Some actions are legal only during planning, approval, execution, verification, settlement, rollback or escalation. Permission without phase can be too broad.
Transition
Represent material actions as explicit state edges:
Then attach invariants to the edge and destination instead of relying on a vague success message.
Time
Agent work is increasingly asynchronous. A permission valid at planning time can be stale at execution time. A retry can occur after external state has changed. A2A's explicit task status timestamps are one signal that time belongs in the model.
Recovery
Recovery is not simply retry. Safe return paths may require idempotency, compensation, rollback, reconciliation, human escalation or explicit abandonment. Durable execution systems make this a first-class concern rather than an afterthought.
Verification
A transition needs a checkable invariant. A payment refund must not exceed captured value. A production change may require an approval bound to the current operation. A task should not enter completed state until required evidence exists.
Evidence
Evidence can include traces, state snapshots, diffs, receipts, signatures, attestations, policy decisions, timestamps, tests and approvals. Useful evidence is not "log everything." It is evidence bound to a claim and a transition.
A minimal trust record
A practical system could emit one compact record for every material transition:
{
"trajectory_id": "tr_01...",
"actor": "agent://refund-specialist",
"phase": "execution",
"state_before": "captured",
"action": "refund",
"state_after": "refunded",
"cause": "approved_refund_request:r_42",
"invariants": ["refund_total <= captured_total"],
"recovery": "reconcile_or_compensate",
"evidence": ["trace:...", "receipt:...", "policy:..."],
"verification": "passed"
}The schema is illustrative. The important idea is binding identity, state, transition, time, cause, recovery and proof into one inspectable path.
Why existing primitives are not enough alone
Can block selected inputs, outputs or tool calls, but do not automatically provide cross-system recovery or provenance.
Can reconstruct execution and causality, but does not by itself prove domain invariants or authorization semantics.
Can model lifecycle and persistence, but does not prove that a probabilistic actor chose a legitimate transition.
Can resume progress after failure, but cannot decide whether the business action itself was correct.
Can prove identity and artifact integrity, but not the full causal validity of the workflow that produced the artifact.
Can authorize an action, but without state, phase and evidence the permission can remain too coarse.
Counter-signal: maybe no new layer is needed.
The strongest alternative explanation is that this problem should be solved by integrating existing systems rather than creating a new category of infrastructure. That may be right.
RESONANCE's claim is architectural, not commercial: the guarantees must be connected. Whether that connection becomes a protocol, a schema, an observability convention, a policy runtime or simply good application architecture remains open.
There is another important limit. OpenAI's own guardrail documentation shows that different tool classes do not all share the same guardrail pipeline. That is a useful reminder that the word "guardrail" should never be treated as a universal guarantee.
From philosophy to QA
The Trust Graph becomes useful when it produces test cases.
Failure taxonomy
State: agent acts on stale balance.
Causality: action cannot be tied to the request that triggered it.
Phase: production write occurs before approval.
Transition: illegal state edge is accepted.
Time: authorization expires before execution.
Recovery: retry duplicates a non-idempotent payment.
Verification: success is declared without checking the invariant.
Evidence: no durable artifact proves what changed.
This turns "agent safety" into system behavior that can be modeled, tested and reproduced.
What builders should create now
- Trajectory ID. Give the whole action path one durable identity.
- State transition record. Preserve before, action and after.
- Invariant check. Attach a machine-checkable condition to material transitions.
- Recovery contract. Define retry, compensate, reconcile, escalate or stop.
- Evidence bundle. Bind trace, policy decision, artifact or receipt, timestamp and verification result.
The strongest trust system is not the one that says safe. It is the one that can show the path and let somebody else check it.
Primary references
- OpenAI Agents SDK — loops, tools, handoffs, sessions, guardrails, human-in-the-loop and tracing.
- OpenAI Agents SDK — Guardrails — tool checks and documented scope limits.
- OpenAI Agents SDK — Tracing — traces and spans for agent activity and handoffs.
- A2A Protocol Specification — stateful tasks, lifecycle, timestamps, history and artifacts.
- OpenTelemetry — Context propagation — causal context across distributed boundaries.
- Temporal Documentation — durable execution and recovery after infrastructure failure.
- Sigstore / Cosign — Verification — artifact signatures and attestations.
- Sigstore — Security model — guarantees, trust assumptions and limitations.
The RESONANCE Trust Graph is a synthesis built from these systems concepts. The sources support the component claims; they do not claim or endorse the combined framework.
RESONANCE verification chain
Signal → Claim → Source → Evidence → Cause → Timeline → Uncertainty → Verification → Implication → Action
Read Article 001 Continue Issue 001 →