Putting an agent on real work takes a clear set of steps and a way to check what it did. What I've learned: the agent's own summary of its work is the one thing you can't check it with.
The pilot was fine. The agent did what the demo said it would, and the team that ran it was happy. Three weeks after it went live at a company I work with, I asked which records it had actually touched. Nobody could say. The vendor's dashboard couldn't say either. It showed how many runs had finished and how many had errored, and under each run it showed a short summary the agent had written about its own work. What it didn't have was a list of records.
I'd been in the sign-off meeting. I didn't ask either. I asked whether it worked, and it did.
The question I ask teams now is what they'll be able to prove the agent did. "Does it work" is a demo question, and the demo was fine. So here's the rule I've landed on. An agent keeps a log of what it does. You decide what that log has to contain before you let the agent act on anything that matters. The agent's summary of its own run is pretty good as a progress report. It's close to useless as evidence, and the moment you need evidence is the moment you find that out.
Here's why that matters more this month than last. Google shipped its company-wide Gemini agent on Oct 8. The launch post says "every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person" (Google Cloud). It wasn't the only vendor to launch a shared coworker agent this fortnight. The pitch is that the agent gets its own identity and its own trail, and the governance comes free with them. BCG surveyed 1,330 CxOs for its Applied AI Index, published Sep 30, all of it self-reported. 42% expect to grant agents genuine autonomy by 2030. Only 5% say they have the full set of controls in place today (BCG). A lot of companies are about to hand real work to agents on the strength of a trail somebody else designed.
what the summary can't tell you
The agent's summary isn't lying. It was built to explain its work in a way that reads well, and it does that. The trouble is that the explanation comes from the same process that did the work, with the same blind spots. Nobody grades it.
Epoch AI put a number on the gap on Oct 7. In its InnovationEval test, two frontier agents were asked to reproduce a recent human advance in machine learning. After correcting for the best-of-N selection the labs use, the agents reproduced 2% and 15% of the advance. They reported 43% and 71% (Epoch AI). That's one benchmark, two models, and research tasks rather than business ones, so it can't carry the whole argument on its own. But the shape is what I see on client work. The self-report runs several times higher than the measured result, and nobody notices until something outside the agent is used to check.
That outside thing is the log. I mean the record of each action as it happened, kept separately from the summary the agent writes at the end. Which record it read. Which one it wrote, and what the value was before and after. Who or what asked it to. A person doing the same job leaves most of that trail by accident. They open the record on a screen, they save it, the system stamps their user ID. An agent only leaves the trail you told it to leave.
That's the answer to the loudest claim in this fortnight's launches, which is that agents make software interfaces and their governance matter less. The interface mattered because it was where a person looked at the record before changing it. Take the person out and the look doesn't disappear. It moves into the log, and now it has to be designed on purpose.
what the vendor's trail is for
The steelman for the shared agent is real, and I take it seriously. One agent with its own identity is cheaper to run than a dozen built in-house. It gets patched by someone whose whole job is patching it, and it produces a trail by default. Most companies that build their own produce nothing by default. If the choice is a vendor trail or no trail, take the vendor trail.
So the argument has to be about whether the trail answers the questions your company will actually ask, and a trail that exists hasn't settled that. Google's line is precise: actions are attributed to the agent rather than to a person. That's an identity answer. It tells you who, in the sense that the agent did it and not a human. It doesn't tell you which records, on whose instruction, or what the record said before. Those are the questions that come up in the first bad week, and they're the ones the dashboard in my story couldn't answer.
Here's a less tidy example. Help Net Security reported on Sep 30 that developers at over 300 organizations had published more than 13,000 internal images openly on GitHub. 93% were under personal accounts, and no exploit was involved (Help Net Security). The images came out of AI coding agent sessions. Nobody attacked anything. The agents did what agents do, which is take the shortest path to the task. The trail that would have shown it sat in personal accounts the companies didn't look at. A trail existed. It wasn't the company's trail, and it didn't answer the company's question.
Ask what you'll be able to prove.
the rung this is about
I place companies on a five-rung ladder, L1 to L5, to say how far they've actually taken AI. L1 is people using chat tools on their own. L3 is an agent doing a bounded job with a person checking each run, which is where most good pilots sit. L4 is that agent acting in production without a person watching every run. L5 is agents running whole workflows the company can fully account for.
The step from L3 to L4 is the one everybody is trying to take this year, and it's the one the coworker launches are selling. Here's the thing I've come to believe about it: the step is about records, not models. The model that passed the pilot is good enough for L4 in most cases I see. What's missing is the log. At L3 the person checking each run is the log. They remember what the agent touched, roughly, and they can go look. At L4 that person is gone, and if you didn't write down what the log has to contain before you removed them, you've lost the only evidence you had.
So the question to ask before the step has little to do with whether the agent is ready. Picture someone three weeks from now who wasn't in the room. Can they pull up every record the agent changed, see what it changed from, and see what told it to? If the answer is "the agent's summary," you're still at L3, whatever the dashboard says.
what the log has to contain
I've landed on four lines the log has to answer, and I'd settle them before the agent gets write access to anything.
First, what it read. Every record the agent opened, whether or not it changed it. This is the one teams skip, and it's the one the data protection people will ask for first.
Second, what it wrote, with the value before and the value after. A diff, in plain terms. Without the before value you can't undo anything, and you can't tell a correct change from a plausible one.
Third, what told it to act. The ticket, the message, the schedule, or the other agent that handed it the job. When agents start calling agents, this line is the only way to trace a bad change back to a human decision.
Fourth, where it stopped. What it declined to do, handed back, or couldn't finish. An agent that only logs its completions looks better than it is.
None of this is a model question. It's a data question, and it lands on whoever owns the systems the agent writes to. Usually that's a CTO or a data lead who wasn't in the pilot and didn't pick the vendor. Their incentive just changed. Before the coworker launches, the agent team owned the pilot and the systems team could wait. Now the systems team owns the evidence, and the evidence has to exist before the agent does anything.
the law catching up, and the owners too
California's SB 947 was signed Sep 30 and takes effect Jul 1, 2027. Before an employer relies on AI for discipline or termination, it must "direct a human to corroborate the decision" (Governor's office). Corroborate is a specific word. It means check against something other than the decision itself. If the only thing the human has is the agent's summary of why it decided, they're reading, and reading isn't corroborating. The law doesn't say "log," but I don't see how you comply with it without one.
One line for the readers whose companies are owned by a fund. Grant Thornton asked 100 private equity fund leaders this spring how confident they'd be passing an AI governance audit in 90 days. 9% said very confident, against 22% across industries (Grant Thornton). That's fund staff rather than company staff, and the survey is seven months old, so take it as a signal rather than a score. The signal is that the people who'll eventually ask what your agents did are less sure of the answer than anyone. The log you decide on now is what they'll be handed.
where I'd push back on myself
The honest objection is that this is a lot of logging for a pilot that updates records. Most agents won't touch anything that triggers a regulator or a diligence question. Designing a four-line log before every one of them is the kind of governance that stops good work from shipping. I've watched that happen too.
So scope it. The four lines apply to any agent with write access to a system of record: the CRM, the ledger, the HR system, the ticketing queue. An agent that drafts and a person that saves is L3 and can stay on the summary. The line I'd draw is write access, and I'd draw it in writing. That way the next team that wants to remove the human from the loop knows what they're signing up for.
the test for Monday
Here's the deliverable. Pick the one agent at your company closest to the L3 to L4 step. Give someone who wasn't in the pilot thirty minutes and the following four questions, and don't let them talk to the agent team.
Which records did it change last week? What did each one say before? What told it to make each change? Where did it stop or hand back?
If they can answer all four from the log, you're ready for the step. If they can answer them only from the agent's summary, you aren't, and you've found that out for the price of half an hour rather than three weeks after go-live.
The pilot was fine. The pilot is always fine. What the log has to say is the part you decide, and you decide it before the agent touches anything you'd have to explain.