{"slug": "the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust", "title": "The receipt, not the demo: Four questions that earn AI agent trust", "summary": "CadreAI, an AI executive assistant built inside Cisco's DevNet Platform Engineering organization, routes every tool call through a deterministic policy engine rather than letting the language model decide whether an action may proceed, and writes every allowed or denied action to a hash-chained audit log. The agent runs against real Kubernetes, mail, and incident workflows in DevNet, with deployments gated behind human approval and a dry run, and each wake cycle passing through the same gate as a live conversation. The design addresses the trust gap the piece identifies: a demo shows what an agent can do, while the audit log is the receipt proving what it did and who approved it.", "body_md": "Every vendor can show you an impressive demo now. Almost none of them can show you the receipt afterward, and the receipt is where AI agent trust actually comes from.\n\nPicture the morning after. An agent pushed a change to a cluster overnight, and someone asks who approved that deployment. If the only record is the model’s own summary of what it did, the honest answer is memory and good faith. A demo shows what an agent can do, not what it may do or how anyone would know afterward.\n\nYou want an agent to take the toil off your team, but you can’t hand it production on faith. CadreAI is how we approached it: an AI executive assistant built inside DevNet Platform Engineering that works across mail, calendar, Webex, ticketing, incidents, and Kubernetes deployments. Four questions decide whether it, or any agent, belongs near production:\n\n- What may it touch, and does the model get a vote?\n- Who approves the actions that matter?\n- Can anyone prove what happened after the fact?\n- Does it behave the same at 3am as at 2pm?\n\nGet those answers right, and engineers can hand routine work to an agent and keep the judgment for themselves.\n\n### It does real work, which is exactly the problem\n\nCadreAI now carries much of a working day, which not long ago would have sounded like a gimmick. Ask it what’s waiting, and it pulls up the Webex thread that blocks a decision, not an unread-mail count.\n\nWhen a task spans several systems, the agent carries the context across, so a person no longer acts as the integration layer between tools that don’t talk to each other. And it’s no prototype: CadreAI already runs against real Kubernetes, mail, and incident workflows inside DevNet.\n\nPeople notice the convenience first. It should also make a security team nervous, and plenty of security teams have left agent demos more worried than impressed. They’re right to be. A capable model is no longer the hard part. What that model is allowed to do with your systems is.\n\n### The model proposes, the policy engine decides\n\nIn CadreAI, the language model never decides whether an action may proceed. Every tool call, down to reading a single file, goes through a deterministic policy engine first. The engine checks the caller’s identity and role, and for anything consequential it checks the specific arguments too.\n\nThe model can propose anything it likes, but it does not also get to judge. When the engine says no, the agent reports the refusal plainly and doesn’t hunt for a way around it. You scope an agent by editing policy, and no prompt can talk its way past a rule the model never evaluates.\n\nEvery request gets one of three answers: refused outright, routed to a human approver, or allowed to run because it’s routine. Deployments sit behind the approval gate. A person reviews a concrete change and a dry run before anything touches the live cluster, and after the rollout the agent checks the live workload instead of assuming it works because a script exited zero.\n\n### The audit log is the receipt\n\nCadreAI writes every action, allowed or denied, to a hash-chained audit log. Each entry is tied to the hash of the one before it, so anyone who edits an entry later breaks the chain.\n\nThe log holds the actual decision and the actual arguments, not a summary the model wrote about itself. That’s the receipt.\n\nWithout it, the answer to “who approved that deployment?” rests on memory and trust. With it, the answer is a record anyone can check.\n\n### No extra authority at 3am\n\nCadreAI wakes on its own schedule, and each wake passes through the same gate as a live conversation. The 3am check and the 2pm request get identical treatment, so nothing gains authority because nobody is watching.\n\nIt isn’t one agent with access to everything. Mail and calendar live in one specialist; the ticketing integration lives in another. Each proves its own identity and holds no authority until someone grants it a role.\n\nDevOps culture learned the same lesson: taking down the walls between teams does not mean nobody owns anything. A specialist’s blast radius, the damage it could do on a bad day, stays inside its role.\n\n### The engineer keeps the judgment, not the toil\n\nTake an ordinary week. A scanner flags a container image with a known CVE, something that happens a dozen times a month. A governed agent turns each flag into research and a proposed diff.\n\nThe agent does not need to be smarter than the engineer. It needs to be honest about what it did, and the system around it needs to make overreach impossible instead of merely discouraged.\n\nThe engineer still decides what role an agent receives and still gets paged when something is truly ambiguous. What leaves their plate is the work that was never really a judgment call: the research, the boilerplate fix, and the verification step people skip when they’re tired.\n\n### AI agent trust is earned one receipt at a time\n\nTrust comes from evidence. A capable model, a narrow role, and a gate that behaves the same every time let a team widen an agent’s authority as the audit trail shows the pattern holds. That claim is smaller than “AI replaces SRE work,” and more useful.\n\nBring the four questions to your next agent demo, and when it ends, judge the agent by what it can prove afterward. If you’re building a policy layer of your own, reach out to the DevNet Platform Engineering team to compare notes.", "url": "https://wpnews.pro/news/the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust", "canonical_source": "https://blogs.cisco.com/cisco-devnet/cadreai-ai-agent-trust-production", "published_at": "2026-10-20 19:00:00+00:00", "updated_at": "2026-10-20 19:18:10.290251+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy"], "entities": ["CadreAI", "DevNet Platform Engineering", "Cisco", "Webex", "Kubernetes"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust", "markdown": "https://wpnews.pro/news/the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust.md", "text": "https://wpnews.pro/news/the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust.txt", "jsonld": "https://wpnews.pro/news/the-receipt-not-the-demo-four-questions-that-earn-ai-agent-trust.jsonld"}}