A Signature Is Not a Premise

Every serious attempt to secure agentic transactions this year has produced the same artifact. A signed record. It establishes something narrower than it appears to.

Every serious attempt to secure agentic transactions this year has produced the same artifact. Payment protocols emit execution receipts. Identity vendors emit signed authorization tokens. Inline security layers return attested verdicts. Agent frameworks publish trust chains that bind stated intent to recorded outcome. In each case the signed record is offered as the thing that makes the action accountable.

It establishes something narrower than it appears to. A signature shows that a particular decision was made over a particular set of inputs, and that nobody altered those inputs in transit. It shows nothing about whether the inputs were true.

That gap is harmless when the party signing and the party being described are different. A bank signs a statement about an account balance the bank itself holds. The signature and the fact are sourced from the same authority, so the signature carries the fact.

The gap becomes load-bearing when the proposer and the premise supplier are the same party. If the runtime that requests an action also supplies the facts the authorization is evaluated against, then the cryptography has faithfully authenticated a decision made over inputs the requester chose. What comes out is a signed copy of the requester's account of itself, carrying the visual weight of independent verification.

Signing has been misread before

This misreading has a long record in security engineering, and each time the correction took years.

A valid TLS certificate proves that traffic reached the domain that was requested and that nobody sat in the middle. It has never proven that the operator of that domain is honest. Phishing infrastructure has carried valid certificates for a decade. The industry eventually stopped treating the padlock as a trust signal and started treating it as a transport property, which is what it always was.

DKIM proves that a message left a domain unaltered and was signed by a key that domain published. It says nothing about the content. Well-formed fraud passes DKIM every day, because DKIM was designed to establish integrity and origin rather than truth. DMARC exists because the industry needed a second layer to reason about what the first layer never claimed.

In both cases the failure was the same. A mechanism that established integrity was read as though it established validity. The signature was treated as an endorsement of the payload.

Agent governance is currently making the identical substitution, at higher stakes and with less time to correct it.

What autonomy collapsed

Two things changed at once.

The first is structural. In pre-agentic systems the party asserting a fact and the party acting on it were usually distinct, and a human sat between them. A person stated intent, a system recorded it, and a separate authority validated the person. The proposer of an action was rarely the sole source of the facts that qualified it.

Agentic execution collapses those roles. An agent proposes an action and, in most current designs, also supplies the identity claim, the target reference, the amount, and the classification of what kind of operation this is. Each of those is a premise the authorization depends on. Each arrives from the party whose action is being authorized. There is no human left in the loop to state intent independently, which was the mechanism that used to keep the roles separate without anyone designing for it.

The second is consequence. Agents now move money, provision access, and take actions that do not reverse. A falsely premised decision used to produce a bad log entry. It now produces a settled transaction with a cryptographic record attesting that it was authorized, which is a materially worse outcome than no record at all. A signed false premise is harder to unwind than an unsigned one, because it survives review.

Premise provenance

The discipline this calls for is not more signing. It is classifying, for every input a decision depends on, where that input's authority came from.

Three classes cover the field.

Independently sourced. The deciding authority obtains the value from a trusted source rather than from the requester. The requester's version of the value, where one exists, is treated as a reference to be resolved rather than a fact to be accepted. Identity resolved against a registry, entitlement read from the system that grants it, and policy loaded from a separately signed bundle all sit here.

Bound, not verified. The requester supplies the value. The authority binds it cryptographically so it cannot be altered in transit or later disowned, but does not independently confirm it is true. A mismatch is detectable or reconcilable after the fact rather than prevented at decision time. This class is honest and unavoidable. It is also the class that must be enumerated by name.

Declared, non-authoritative. Recorded for audit or proposal semantics, granting no authority, unable to override a value obtained from a trusted source. Session references and free-text context belong here.

The operating rule follows directly. Sign nothing that was not independently sourced, and where an input carries authority but cannot yet be independently sourced, bind it and name it as a residual with a stated path to closure.

The claim worth making carefully is that residuals are normal. Every real system has inputs it binds without verifying, usually because independent sourcing requires cooperation from a party that has not yet agreed to provide it. The presence of residuals is not a defect. The absence of a residual list is. A system that reports no unverified premises has not audited itself, and a system that cannot enumerate which of its inputs sit in each class has no basis for the assurance its signature implies.

The invariant that keeps this from decaying is procedural. Any new decision input is classified before it ships. Nothing new becomes an authority-bearing premise on the strength of arriving inside a signed envelope.

What this changes for three audiences

For builders, the audit is cheap and nobody is doing it. Enumerate every field a decision reads, mark its class, and look at what remains in the second column. The exercise reliably surfaces at least one input that was silently promoted to authoritative because it was convenient to trust, and the remedy is usually to derive it from policy rather than accept it as declared.

For buyers, the useful question is no longer whether a vendor produces signed records. It is which premises the vendor sources independently and which it accepts from the agent. A vendor who can answer that in specifics has done the work. A vendor who answers by describing key management has heard a different question.

For auditors and regulators, this is where the exposure concentrates. Signed agent decision records are already being positioned as compliance evidence. A record that does not carry provenance per field launders the agent's assertions into the evidentiary chain and gives them the standing of verified facts. Any framework that admits these records as evidence will need to distinguish the fields the deciding party sourced from the fields the acting party supplied, or it will be admitting self-attestation with extra steps.

Signed means unaltered. It does not mean true.

Cross-link: this piece extends the argument opened in N° 020 (The Authorization Gap) by naming the failure mode inside signed records themselves. Direct structural parallel to N° 029 (Detection Is Downstream of Authorization), which argued that classification after the action is not authorization at the moment of action. Same failure pattern applied to different substrates: N° 029 to detection, this piece to the signed record itself. Companion in spirit to N° 018 (The Question No One Signed) on the signature-versus-reviewable-reading gap in the accountability arc, N° 021 (The Number That Wrote Itself) on cryptographic citation laundry, and N° 028 (Compliance Is Not an Inventory) on signed evidence records versus the operating reality they describe. TLS-certificate and phishing-infrastructure claims verified against Chrome and Firefox security-indicator history and Let's Encrypt phishing-abuse literature. DKIM and DMARC roles verified against IETF RFC 6376 (DKIM) and RFC 7489 (DMARC). No external attribution is claimed for the three-class premise-provenance taxonomy proposed in this essay. Reciprocal: FederatedIQ classifies premise provenance per field in its decision records at federatediq.ai.