The era of agents is here.

An agent receives the work, hands off to the next agent, which hands off again, down to the agent that records the outcome. Each handoff is itself an action that needs attribution, and each receiving agent decides on the previous agent's record. The seam between agents is where the work actually lives, and the seam is what coordination governs.

• The chain is legible at every link: which agent acted, which received, in what order, on which data, under which policy.
• Handoffs carry the record forward. The receiving agent inherits the audit context the prior agent emitted, not a summary of it.
• Branching is governed. When a decision splits into parallel actions, every branch is tracked as an attributed action of the agent that branched.
• Multi-agent dependencies surface where the work crosses. Asking which agent did this gets an answer, not a guess.

The policy that authorizes an agent action is not a slide, a wiki page, or a guardrail that catches mistakes after the fact. It is code, reviewed by your team, deployed alongside Plexus. The substrate records the action and the outcome, attributable to the policy version that applied, and the record survives the action. Applying the policy at the decisional event is the role of the runtime, in active development.

• Reviewable: pull-request review by your model-risk, compliance, and security functions. The version that authorized an action is the version the auditor reads.
• Testable: the policy can be run against representative actions before it lands. Coverage of the decision space is a property of the policy.
• Recorded where the action happens: not at an API gateway hours later, not at a dashboard watching afterward, but at the event itself.
• When an action is refused, the refusal is recorded: an attributed audit event showing the agent that attempted and the outcome.

Each recorded action is hashed into a chain whose continuity an auditor can prove was not altered, from the first record to the current state. Operators cannot rewrite the record. Agents cannot rewrite the record. The substrate cannot rewrite the record.

• Hash-chained at write: each action's hash includes the prior action's hash, so the chain verifies from any point back to the start.
• Retention that satisfies the audit window, held for the required retention period, not at the operator's discretion.
• Integrity is provable, not asserted: the verification is something an auditor runs, not something the operator certifies.
• The record is the action. There is no separate logging layer to fall behind or drop fields. The record is produced as the action happens, so no action passes without becoming part of the record.

Tamper-evidence is a property of how the chain is built, not a feature added on top. Any modification to a recorded action, to the substrate that holds the chain, or to a system upstream of it produces a chain that does not verify. The auditor running the verification sees the failure.

• Alteration of a recorded action breaks the chain; the verification fails.
• Alteration of the substrate that holds the chain breaks the chain; the verification fails.
• Alteration upstream (the agent, the policy, the data) is itself a recorded action, attributable to whoever caused it.
• It is built to be auditable not because the operator is trusted, but because the auditor trusts no operator.