Is the verdict a signed receipt, or observational telemetry?

[source-origin]

The framing — most guardrails judge prose at the model boundary, but autonomous agents act, so the execution layer is where the interesting events are — is the right one, and the 3-state verdict (blocked / flagged / allowed) with a local YAML policy engine is a clean design. The seam for me is what the emitted event is.

When the sensor returns flagged or blocked, telemetry goes to whatever you already run (stdout, files, webhooks, OpenTelemetry). Two different things that could be true:

• the event is a signed, tamper-evident receipt binding that verdict to the specific tool call / egress it governs (so a third party can, after the fact, verify "this exact action was flagged under this policy version" without trusting the log store); or
• the event is observational telemetry, and the authority for "what was decided" lives in the store it lands in.

If it's the latter, then the audit trail inherits the trust assumptions of the log pipeline rather than of the decision. Which is it?

Related, and maybe the more important one: you're explicit that cross-agent / cross-session correlation is out of scope for an in-process sensor (needs a stateful backend). When an attack is split across two agents, what's the intended anchor that lets a verifier reconstruct the full decision from the per-process events alone — is the W3C Trace Context delegation provenance enough to stitch them, or is a stateful correlator assumed?