Your agent asked for approval. Where did the answer go?

An agent generates a refund decision. A reviewer reviews it, alters the amount, and adds a note about the customer's contract before approving. The refund is issued. Everyone proceeds. Six months later, someone inquires about the person who approved the refund and why the amount was altered. The agent's draft exists in a trace, the final amount resides in the payments system, but the reviewer's reasoning is only a sentence in a chat thread that has since been deleted.

The fact that a human changed the number is not recorded as a distinct event. The trace shows a call, and the database displays a result. However, no one can demonstrate the decision. This is not an uncommon failure; it is what happens by default because the systems we have developed for AI agents move tasks around without documenting the judgment applied to them.

The protocols that facilitate agent cooperation do their jobs well but do not address this issue. A paper by Kang and Diponegoro highlights this problem by scoring five agent interoperability protocols, including MCP and A2A, against six governance dimensions from organizational theory: membership, deliberation, voting, dissent preservation, human escalation, and audit or replay.

Their findings indicate that while these protocols effectively coordinate tasks, they cannot express a governed community. Governance, they argue, is a missing architectural layer above these protocols rather than a feature within them. This observation aligns with our experience in building AI systems for regulated industries, where clients cannot simply claim a human was involved.

They require evidence, sometimes years later, to someone who is obligated to be skeptical. The logs reveal a call was made, but this does not prove a person exercised judgment. A decision record that merely indicates approval as a boolean fails to capture the essential information. An approval and an edit are different events. If a reviewer modifies the draft before approving it, the final product differs from the agent's initial output, and the distinction is the most crucial aspect of the record.

It is where human judgment actually resides. Therefore, the record must include the agent's output as an artifact, the human's intervention as an override containing the diff, the reviewer's rationale, and a flag indicating whether the edit refined or replaced the agent's intent. Understanding these nuances and aggregating them over many instances can provide a reliable measure of where the agent is falling short, which serves as a byproduct of the audit trail rather than a separate analytics project.

Similarly, rejections and escalations are also significant, for the same reason. A record that only preserves the decisions that proceeded without documenting disagreements discards valuable information, which is counterproductive from an accountability standpoint. What the record needs to be verifiable is equally important. A system's decision record, which can be quietly edited by the system itself, is not evidence.

It is a claim. The solution is well-established: sign each record and chain it using content hash, ensuring each entry commits to the one before it. If any entry is altered afterward, the entire chain becomes invalid. A verifier can then retrace the chain to confirm its integrity without relying on the system that generated it. For enhanced security, this chain can be anchored in an external transparency log, as explored in the IETF's SCITT work.

This optional profile is under development, and discussions are ongoing on the SCITT mailing list, where several implementers have identified and addressed issues we had overlooked. To illustrate the implementation, a protocol named CHAP (Content Hashed Approval Protocol) has been developed. It is an open protocol, licensed under Apache-2.0, and built on top of MCP and A2A as transport mechanisms rather than competing with them.

A Python coordinator provides a runtime-free way to explore a decision record, as demonstrated by a marketing workflow scenario with one drafter and one editor. The scenario prints the chain, verifies its integrity, introduces tampering to demonstrate verification failure at the exact entry, reconstructs a single edit with its diff and rationale, and reports the type of override the editor applied.

The process is deterministic, ensuring consistent results and allowing easy reading of the script to understand its generation. Additionally, the coordinator and framework bridges are available for integration: pip install chap-coordinator pip install chap-langgraph (or chap-pydantic-ai, chap-llama-index, chap-ag2, chap-google-adk) npm install @brightbeamai/chap-coordinator npx -y @brightbeamai/chap-coordinator-mcp.

These resources offer a practical starting point for anyone looking to implement a decision record that meets the necessary governance standards.