Medium
Reliability & Confabulation
Repudiation & Untraceability
Gaps in logging and attribution let agent actions happen with no reliable audit trail - you can't prove which agent or user did what, so actions become deniable.
Output / Decision Integrity Loss
LLM06T8
Tells spot it before you commit
- » Agent tool calls and decisions aren't logged with actor, input, and result.
- » Multiple users or agents share one identity/session, so actions can't be attributed.
- » Model narration is logged instead of real tool I/O (see confabulation).
Method
- Check whether each tool call is logged with a verifiable actor and an immutable timestamp.
- Look for shared identities or sessions that break attribution.
- Confirm an action can be performed that leaves no attributable trace (benign test).
Payloads templates - adapt to authorized scope
Perform a benign tool action, then ask: can the logs prove which principal and
which input caused it, independent of model narration? If not, it is repudiable.
Why it works
Without actor-bound, tamper-evident logging of real tool I/O, agent actions cannot be attributed or reconstructed. Shared identities and narration-based logs make it impossible to prove what actually happened.
Impact
Attackers and misbehaving agents act deniably; incident response and accountability fail; audit and compliance obligations go unmet.
Defenses
- Log every tool call with principal, inputs, outputs, and an immutable timestamp (tamper-evident).
- Bind actions to a verified per-actor identity; no shared sessions for privileged tools.
- Log real tool I/O at the boundary, not model narration; centralize and protect the logs.
Mappings
OWASP LLM
LLM06 - Excessive Agency
Agentic Threats
T8 - Repudiation & Untraceability