I built a system that signs a record of every permit or deny decision an AI agent's tool calls go through, so auditors would have independent evidence instead of the agent's own logs. It worked, it passed my tests, and it was quietly useless: the decision record was written on a path that could race the actual execution, so a record could not prove it came before the action it described.

In ten minutes: how the bug hid, why "we log every decision" is not the same as "we can prove every decision came first," and the simple sequencing rule that fixed it. A short war story with a lesson for anyone building audit trails for AI agents, or for anything else that acts on its own.