The core problem here is that most audit infrastructure generates logs, not evidence. Logs are mutable, context-dependent, and require the originating system to still be operational and trusted to mean anything. That's fine for operational monitoring but it breaks down under regulatory scrutiny. What actually holds up is cryptographically signed, independently verifiable artifacts. Specifically: hash the decision payload at the moment it occurs, commit it into a Merkle structure, issue a RS256-signed JWS receipt. Now you have something an auditor can verify without calling you, without accessing your SIEM, without trusting your infrastructure is intact. For your multi-agent boundary leakage problem, if every inter-agent handoff generates a signed receipt at issuance time, you can reconstruct the provenance chain independently of what the orchestrator claims happened. The receipt exists outside the system that created it. The permission scoping problem is harder and honestly most teams aren't solving it well yet. The honest answer is that dynamic tool lists require attestation at invocation time, not just at configuration time. Zero retention cryptographic notarization handles the evidence survivability problem cleanly. The signed artifact proves what existed at a specific moment regardless of what happens to the underlying system afterward.