AI agents don't just generate text anymore. They call tools, hit internal APIs, move data and trigger payments, usually with whatever credentials the agent runtime happens to hold. When something goes wrong, the only record of what happened is the agent's own log, written by the same component that took the action. That is not evidence; it is self-attestation.

This talk walks through a working proof-of-concept I built as an independent project: a policy enforcement point that sits between the agent and its model and tool calls, runs in your own infrastructure, and stays deliberately separate from the agent it governs. Every call is evaluated before it executes, using policy-as-code (OPA/Rego): who is calling, with what scope, against which model, and whether the data is allowed to leave a given region. Every permit or deny decision is then emitted as a signed, tamper-evident record.

We'll get concrete:
- Threat model: prompt injection turning into tool misuse, over-scoped credentials, and agents that quietly route around controls.
- Why every tool or MCP invocation must be treated as its own authorization event, not one decision per conversation.
- Writing policies for agents: identity, scope, model allow-lists and data residency.
- Making decision records worth trusting: signing, sequencing and what an auditor can verify.
- The bug that broke it: my first build recorded decisions on a path that could race the execution, which quietly destroyed the value of the evidence. How I found it and how I rebuilt it.
- Limits: what this approach cannot prove, the "only path to tools" requirement, and why key custody becomes your new problem.

You'll leave with a reference architecture and policy patterns you can apply to your own agent stack, whatever framework you use.