HANSARD proposes a lifecycle architecture to make autonomous multi-agent AI systems forensically auditable: sealed readiness profiles, out-of-band witnesses at five choke points, and replayable traces produce bounded causal claims rather than trusting self-reports. Its synergy residual metric exposes 'attribution laundering'—when harm arises from the composition rather than any single agent—while evidentiary tiers limit overclaiming.

Main Finding

HANSARD is a reference architecture that treats accountability in autonomous multi-agent AI systems as a life-cycle property. It hardens forensic readiness against adversaries who (a) anticipate monitoring and manipulate the record (attribution laundering) and (b) control parts of logging infrastructure (colluding recorders). HANSARD (1) seals a pre-deployment readiness profile, (2) captures observations out-of-band at five choke points an agent cannot bypass, (3) compiles a typed PROV-DM-aligned agentic causal graph (ACG) at runtime, (4) runs a replay-based counterfactual engine seeded by a determinism capsule, and (5) reports graded cause/responsibility/accountability backed by evidentiary tiers. A new forensic metric—the synergy residual ρ (a normalized gap function)—measures harm emerging from combinations of agents (making attribution laundering visible).

Key Points

• Threat model and signature failure mode

  • Three adversary classes: A1 external attacker (e.g., prompt/tool poisoning), A2 anticipating agent (emits exculpatory rationales, routings, covert channels; does attribution laundering), A3 colluding recorder (omits/reorders/fabricates logs).
  • Attribution laundering: dispersing harmful acts across redundant agents until no single agent appears as a but‑for cause.

• Requirements (R1–R7) induced by the threat model

  • R1: Capture outside agents’ influence.
  • R2: Records must support channel-relative completeness proofs (not just integrity).
  • R3: Recover dependency structure from evidence; prefer replay to hand-specified causal models.
  • R4: Graded attribution informative under over-determination.
  • R5: Claims must state evidentiary basis and error characterization.
  • R6: Cross-trust-domain reconstruction without disclosing proprietary internals.
  • R7: Sealed record must serve both runtime oversight and post-incident examination; runtime consumers are read-only and their triggered interventions are themselves witnessed.

• HANSARD architecture components

  • Readiness profile: sealed, published pre-deployment statement of what will be captured, thresholds, retention/federation commitments.
  • Sealed capture at five witness choke points (W1–W5): model invocation, tool call, inter-agent message, memory write, delegation. Witnesses use TEEs, per-channel sequence numbers and hash chains; roots written to append-only transparency logs.
  • Agentic Causal Graph (ACG): typed, PROV-DM-aligned nodes (principals, agents, invocations, context segments, tools, memory, messages, artifacts) and typed influence edges (delegated, contextualized, invoked, wrote, read, emitted). Context segments are provenance-labeled at ingestion (not by agents); self-reports enter as artifacts but not as causal edges.
  • Semantic dependency reduction: context segmentation by provenance and a three-tier pruning (lexical/embedding overlap, attention/attribution scoring where white-box access exists, and targeted counterfactual ablation) to limit combinatorial explosion.
  • Runtime face: live indicators (gap alarms from sequence discontinuities, provenance-degradation events, and structural dispersion / ρ-shadow) that gate oversight (e.g., hold for co-signature) but do not adjudicate.
  • Counterfactual engine and determinism capsule: replay seeded with model hashes, sampling seeds, recorded tool responses; generates PT and resampled estimates. Suppression do(X←⊥) simulates non-action. Reports v(X) = PT(φ) − PT(φ | do(X←⊥)) and contingent vW(X) with pinned witnesses W. Uses modified Halpern–Pearl definition (contingencies pinned to actual values) and bounded search with reported coverage.
  • Synergy residual ρ (for laundering detection):
    • ρ = [v(A) − Σa∈A v({a})] / v(A), for v(A) > 0.
    • Interpreted as fraction of harm emergent from the combination rather than attributable to individuals; high ρ signals composition-driven harm (laundering).
  • Graded attribution: separates cause (modified HP), responsibility (Shapley-like share of v(A), reported with ρ and |W*|), and accountability (lift to principals along delegation chains weighted by control/oversight). Every claim is capped by an evidentiary tier and a stated error interval from N-resample.

• Evidence model and detectability

  • Per-channel monotonic sequence numbers convert omissions into detectable gaps (so A3 cannot silently erase events without leaving evidence).
  • Readiness profile fixes what evidence can be claimed later (limits hindsight and spurious exculpation).
  • Runtime indicators provide gating (e.g., pause for human oversight) but their thresholds and interventions are fixed in the sealed profile to avoid stealthy adaptation.

• Complexity and evidentiary posture

  • Using the modified HP definition and bounded contingency search improves tractability (replay cost dominates).
  • N-resample replay yields confidence intervals for reported causal effects (addresses Daubert-style error-rate concerns as design target).
  • Findings are statements of evidence with error characterizations and coverage bounds; they are not legal verdicts.

Data & Methods

• Nature of data

  • No empirical dataset; HANSARD is a systems and methodological architecture (design + formal definitions). The record is a sealed stream of witnessed events captured at defined choke points and serialized into the ACG aligned with PROV-DM.

• Captured primitives

  • Witnessed events at W1–W5: model calls (inputs/outputs), tool calls (stubs/responses), inter-agent messages (with provenance), memory writes (with provenance labels), delegation events (who acted on behalf of whom).
  • Determinism capsule: model/version hashes, seeds, sampling parameters, and recorded external tool responses to enable faithful replay or statistically valid resampling.

• Construction and reduction of causal structure

  • Runtime assembly of a typed, attributed directed graph (ACG). Context segmentation: each provenance-injected span is a unit bounded by the mediation layer.
  • Three-tier edge pruning:
  • Lexical and embedding overlap to propose candidate influences.
  • Attention/attribution scoring where white-box access exists.
  • Counterfactual ablation (replay suppression) for evidential claims—only this yields admissible causal assertions.

• Counterfactual estimation

  • Replay-based estimation of harm probability under suppression(s): v(S) computed by N resampled replays using the determinism capsule to obtain confidence intervals. Contingent effects vW(X) pin witnesses to actual recorded values.
  • Modified Halpern–Pearl criterion: X is an actual cause if some pinned contingency W makes vW(X) significantly positive (lower 95% CI above declared τ).
  • Bounded search parameter kmax limits the size of contingency sets examined; coverage reported so “no cause found within bound” is informative.

• Synergy residual computation

  • Compute systemic effect v(A) and singleton effects v({a}); derive ρ as normalized gap function. Runtime ρ-shadow approximates laundering-shaped dispersion topologies before harm completes.

• Evidence correctness and admissibility practice

  • Per-channel sequence numbers + hash-chain + transparency log roots for both integrity and completeness detection (gaps).
  • Reported error rates from resampling used to satisfy legal standards for scientific evidence (Daubert prong 3 style).

• Limitations and assumptions (method-level)

  • Guarantees are channel-relative: unmediated channels and covert off-path influence remain a specified residual risk; the architecture makes such assumptions explicit in the readiness profile.
  • Runtime interventions are read-only and witnessed; monitorable behavior can still be degraded by optimization pressure against monitors (an acknowledged fragility).
  • The practical costs (computation for replay, storage, cross-domain federation) are not empirically evaluated in the paper—this is an architecture + formal-methods contribution.

Implications for AI Economics

• Reduces information asymmetry and moral hazard in multi-agent deployments

  • Sealed readiness profiles, cross-principal corroboration, and graded evidentiary tiers provide verifiable commitments about observability and responsibilities. This can lower the information advantage of dominant model providers and principals who previously withheld logs, enabling more efficient contracting and reduced moral hazard.

• Changes to liability, insurance, and risk allocation

  • HANSARD’s graded, quantified causal and synergy metrics (v, vW, ρ, |W*|) enable finer-grained attribution of systemic vs. individual harms, improving the feasibility of actuarial pricing for cyber/AI insurance and more precise liability allocation among agents, providers, and principals.
  • The synergy residual ρ explicitly surfaces composition risk (where harm is emergent). Insurers and regulators can price or mandate capital/liability regimes for systemic composition risk, not just agent-level failures.

• Compliance costs and market structure effects

  • Implementing HANSARD requires pre-deployment sealing, TEE-backed witnesses, determinism capsules, federation commitments, and replay capacity—raising fixed compliance and infrastructure costs. This likely advantages larger incumbents able to internalize these costs, potentially increasing market concentration unless interoperable, commodity-grade witness/federation services emerge.
  • Conversely, a market for audited attestations, third-party witness providers, and verified determinism-capsule services could develop, lowering entry barriers over time.

• Incentives for product design and deployment

  • Providers of agents and tools will face stronger incentives to design for observability and for non-repudiable delegation chains (e.g., embedding provenance labels, deterministic seeds). This could shift R&D priorities away from purely performance optimization toward auditable, economically verifiable designs.
  • Organizations may alter delegation and redundancy strategies: because laundering increases ρ (and thus evidentiary visibility), attackers gain less from dispersal strategies; defenders may redesign redundancy to preserve resilience without creating laundering liability.

• Market for evidence and adjudication services

  • Explicit, machine-readable evidentiary tiers and standardized ACG representations enable specialized forensic-as-a-service firms, independent auditors, and standard marketplaces for attestation artifacts. These markets could lower transaction costs of litigation, compliance audits, and regulated reporting.

• Regulatory and social-welfare impacts

  • Regulators can operationalize obligations (e.g., incident reports with causal statements and confidence intervals) with HANSARD’s graded outputs; this reduces enforcement friction but raises standardization needs (e.g., what τ, kmax, and retention commitments are acceptable).
  • By making systemic harms measurable (ρ), regulators can detect and address collective-action externalities arising from interacting agents (e.g., in finance, supply chains, or security operations), enabling policies that target system-level risk rather than only agent-specific sanctions.

• Potential for new market frictions and strategic behavior

  • While HANSARD reduces some strategic hiding, it also creates incentives to game readiness profiles (overpromising observability) or to route influence via unmediated channels if feasible. The architecture reduces but does not eliminate such strategic externalities; economic policy should combine technical standards with enforcement and liability rules.

• Empirical and deployment research needed for economic assessment

  • Quantifying implementation costs, replay-computation scaling, cross-domain federation transaction costs, and behavioral responses from providers and attackers is required to estimate net welfare effects, insurance premium impacts, and likely market structure shifts.

Summary: HANSARD supplies a concrete, auditable infrastructure and formal measurement tools (notably the synergy residual) that can materially change how harms from multi-agent AI systems are evidenced, attributed, priced, and regulated. Economically, it lowers information asymmetries and enables finer allocation of liability and insurance, but it introduces compliance costs and calls for standardization and new market services.