Revaz

The biggest problems in agent trust right now: Our Treeship agent has been live on Moltbook since February, now with 2,000+ karma, tracking what agents and builders keep running into. 1. Prompt logs are not evidence. They show what the agent may have intended, but not what actually ran, changed, shipped, or touched production. 2. Exit 0 is not proof. A green terminal result says the process ended. It does not prove the claimed effect actually happened. 3. Tool identity matters way more than people think. “The agent used a tool” is not enough. What binary ran? What version? With what permissions? In what runtime? 4. Agent work needs provenance at the artifact layer. The proof should travel with the output itself, not sit in a dashboard, Slack thread, or CI log nobody checks later. 5. Runtime authority is becoming the real security boundary. The important question is not only “what did the model say?” It is “what was the agent allowed to do when it acted?” 6. Permissions need an after-action record. If an agent touched files, APIs, secrets, tools, network, shell, browser, or deploy keys, that scope should be legible later. 7. Versioning is part of trust. Same agent, different model, different tool version, different runtime, different permission set — that is a different execution context. 8. Memory is not a notes app. Agent memory has to answer what was used, what was ignored, what was superseded, what was withheld, and what evidence exists after the agent acts. 9. Context compression is not memory. Summarizing a long thread helps the model continue, but it does not create a trusted record of what should influence future actions. 10. Retrieval is a provenance problem. Search agents are not only fooled by one bad source. They are fooled by trails that look independent but all point to the same poisoned story. 11. Rollback is not time travel. It is a fork of authority. If an agent restores, retries, or branches, the trust chain should show what changed and why. 12. Blocked actions are evidence too. A trust system should preserve the “no,” not only the “yes.” Refused grants, denied tools, and withheld access matter. 13. Receipts beat transcripts. A transcript is useful for humans. A signed receipt is useful for systems, audits, retries, delegation, and verification. 14. Signed does not mean true. It means the claim has provenance and integrity. Correctness still needs tests, witnesses, policy checks, and effect evidence. 15. Delegation creates a proof problem. Once agents call other agents, summaries are not enough. The parent agent needs verifiable handles for what the child agent actually did. 16. Handoffs are trust boundaries. When work moves from one agent, runtime, repo, or team to another, the receiving side needs evidence, not vibes. 17. Audit trails cannot be reconstructed later. Agents are already entering workflows with real economic value. Receipts need to be produced during the action, not stapled on afterward. 18. Local-first verification matters. If trust only works inside one hosted platform, it is not portable trust. Agents need proofs anyone can verify from the artifact. 19. Agent reputation will depend on execution history, not personality. The useful question is not “is this agent smart?” It is “what has it done, under what constraints, with what proof?” 20. The bottleneck has moved. It is not just whether agents can do useful work. It is whether that work can hold up later across tools, teams, runtimes, and trust boundaries. Don’t trust the agent’s story. Ship a portable receipt.