Your agent run passed. Can you prove it was allowed?

Short version: Most agent teams can show a run, but few can prove whether that run was allowed under a policy. A new policy-as-code audit feature in agent-lab-trust addresses this gap. The audit checks cost and call caps, the declared artifact contract, and forbidden markers, then emits a canonical audit_hash. The audit was run on 13 archived GenMentor runs, with the default contract passing 0/13 and the declared GenMentor contract passing 13/13.

The data remained unchanged, but the contract did. The audit highlights the importance of explicitly declaring the contract, caps, and markers in the policy. The demonstration runs 13 archived GenMentor runs, with the trust-layer default contract failing and the declared GenMentor contract passing. The audit is designed to be unobtrusive, but it reveals that an audit without a specified contract is based on a default contract.

The lesson learned is that an audit must clearly state the contract, caps, and markers to avoid ambiguity. The article emphasizes the need for a governance framework that requires clear policy declarations and reproducible audits.