Back To Knowledge Base
Field Note
Evidence Basics
How to preserve, handle, and explain agentic evidence without compromising privacy or overclaiming certainty.
Agentic evidence can include prompts, model outputs, retrieved context, tool calls, workspace state, terminal history, source-control diffs, MCP logs, API audit trails, and downstream side effects.
Treat these records as evidence, not as truth by default. Preserve originals, document transformations, and separate observed facts from inference.
Preserve First
- Copy logs and session stores safely before analysis.
- Record source paths, timestamps, and collection commands.
- Hash important artifacts when chain of custody matters.
- Avoid opening tools that may mutate session state or rewrite local indexes.
Handle Secrets Carefully
Agent sessions may contain API keys, environment variables, customer data, private code, prompts, or internal URLs. Redact public reports by default and avoid sharing raw transcripts unless the recipient has a clear need.
What This Can Prove
- A record existed at collection time.
- A tool call, command, or output was logged by a specific source.
- A sequence of events is consistent with the preserved artifacts.
What This Cannot Prove Alone
- That the log source captured every action.
- That the model reasoned exactly as the transcript implies.
- That a downstream change was caused only by the agent.
Privacy Posture
- Prefer redacted excerpts over full raw transcripts.
- Hash raw values when correlation is needed.
- Use synthetic fixtures for demos and tests.
- Label inferred content clearly.