# From Traceability to Justifiability: Accountability Structures in Agentic Software Engineering

arXiv: https://arxiv.org/abs/2608.23610 · HTML: https://mlsanity.com/paper/2608.23610/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 18 of its 46 references that are in the map.
- First posted on arXiv 21 Aug 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 18 of 18)

- [Agentic Software Engineering: Foundational Pillars and a Research Roadmap](https://mlsanity.com/paper/2509.06216/) (2025)
- [From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents](https://mlsanity.com/paper/2606.04990/) (2026)
- ["I see models being a whole other thing": An Empirical Study of Pre-Trained Model Naming Conventions and A Tool for Enhancing Naming Consistency](https://mlsanity.com/paper/2310.01642/) (2023)
- [Towards Semantic Versioning of Open Pre-trained Language Model Releases on Hugging Face](https://mlsanity.com/paper/2409.10472/) (2024)
- [Proof-or-Stop: Don't Trust the Agent, Trust the Evidence -- Loop Engineering for Verifiable Evidence-Gated Lifecycle Control](https://mlsanity.com/paper/2607.14890/) (2026)
- [AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems](https://mlsanity.com/paper/2606.21877/) (2026)
- [The Responsibility Vacuum: Organizational Failure in Scaled Agent Systems](https://mlsanity.com/paper/2601.15059/) (2026)
- [Operationalizing Research Software for Supply Chain Security](https://mlsanity.com/paper/2601.20980/) (2026)
- [The Semi-Executable Stack: Agentic Software Engineering and the Expanding Scope of SE](https://mlsanity.com/paper/2604.15468/) (2026)
- [Governed AI-Assisted Engineering: Graduated Human Oversight for Agentic Code Generation in Regulated Domains](https://mlsanity.com/paper/2606.22484/) (2026)
- [Agentic Configuration Management (ACM): A Reference Configuration Model for Governed Agentic Systems](https://mlsanity.com/paper/2608.11166/) (2026)
- [Enabling Ethical AI: A case study in using Ontological Context for Justified Agentic AI Decisions](https://mlsanity.com/paper/2512.04822/) (2025)
- [On Good Authority: Release-Authority Measurement for Registry-Mediated Package Ecosystems](https://mlsanity.com/paper/2606.22593/) (2026)
- [Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code](https://mlsanity.com/paper/2607.06194/) (2026)
- [When Model Release Meets Model Reuse: Producer-Consumer Misalignment in Hugging Face](https://mlsanity.com/paper/2607.21738/) (2026)
- [Silent Updates: Measuring and Closing the Post-Deployment Disclosure Gap](https://mlsanity.com/paper/2608.11803/) (2026)
- [Where Accountability Lives: Mapping Human Responsibility to Workflow Artifacts in Agentic Software Development](https://mlsanity.com/paper/2608.15678/) (2026)
- [Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems](https://mlsanity.com/paper/2608.18180/) (2026)

## Abstract (arXiv)

A pipeline promoting an AI system publishes records claiming the thing evaluated is the thing deployed and that the evidence licensed the transition. We measure, from public material only, whether those records can express that claim and whether it holds where declared. First, a two-class documentation survey of 47 delivery platforms (20 CI/CD, 27 model-serving/agent) under one fixed three-label protocol, graded twice (second pass blind), every consulted page pinned by content hash and date. Across 188 double-graded cells we found no platform whose default record emits a content-addressed identity of the behavioral tuple (model version, instructions, tool definitions, retrieval and runtime configuration); the blind pass grades that column default on zero of 47. Immutable nominal versioning is meanwhile arriving as the agent platforms' default answer (16 of 27): version integers behind mutable pointers, a layer the artifact supply chain already found insufficient. Second, an instrument computes realized assurance depth from a pipeline's published exhaust alone and compares it with the declared depth. Applied to a frozen two-stratum frame of 30 public repositories graded twice from a hashed archive (second pass blind; cell-level agreement 23 and 19 of 30, both passes independently finding the same five full realizations), the sharpest result is a verifiability hole: seven of the 15 repositories chosen for adopting attestation tooling publish source-only releases, so the binding their workflows declare cannot be checked where declared. Where checkable it mostly checks out: five of seven measurable adopters realize the binding end to end; both shortfalls fall at identity binding. Together the results locate the field's records structurally short of justifiability, the one rung that can refuse a transition. The survey carries an expiry clock; we state what would falsify each finding.