{"slug": "your-agent-asked-for-approval-where-did-the-answer-go", "title": "Your agent asked for approval. Where did the answer go?", "summary": "An engineer's blog post argues that AI agent protocols like MCP and A2A fail to record human judgment in approval workflows, citing a paper by Kang and Diponegoro that scores five protocols against governance dimensions. The post proposes a solution: signing decision records and chaining them by content hash, optionally anchored in an external transparency log like IETF's SCITT, to create tamper-evident audit trails.", "body_md": "An agent drafts a refund decision. A reviewer reads it, changes the amount, adds a line about the customer's contract, and approves. The refund goes out. Everyone moves on.\n\nSix months later somebody asks who approved that refund, and why the amount changed. The agent's draft is in a trace. The final amount is in the payments system. The reviewer's reasoning was a sentence in a chat thread that has since scrolled away, and the fact that a human changed the number at all is not recorded anywhere as a distinct event. The trace shows a call. The database shows a result. Nobody can show the decision.\n\nThis is not an unusual failure. It is what happens by default, because the plumbing we have built for AI agents moves work around without recording the\n\njudgment applied to it.\n\nThe Model Context Protocol connects an agent to tools. A2A lets agents discover one another and exchange messages. Both do their jobs well, and neither is trying to do this one.\n\nA paper by Kang and Diponegoro makes the point precisely. They take five agent interoperability protocols, including MCP and A2A, and score them against six\n\ngovernance dimensions drawn from organisational theory: membership, deliberation,\n\nvoting, dissent preservation, human escalation, and audit or replay. Their\n\nconclusion is that these protocols coordinate tasks but cannot express a governed\n\ncommunity. You cannot state in MCP who is allowed to approve something, how a\n\ndissent is preserved, or when a human must be brought in. Governance, they argue,\n\nis a missing architectural layer above these protocols rather than a feature\n\ninside them.\n\nThat matches what we kept running into. We build AI systems for regulated\n\nindustries, where a client cannot simply assert that a human was in the loop.\n\nThey have to produce the evidence, sometimes years later, to somebody who is paid\n\nto be sceptical. \"The logs show a call was made\" is not evidence that a person\n\nexercised judgment.\n\nThe temptation is to log an approval as a boolean and move on. Approved: true.\n\nThis is where most implementations start, and it is worth being clear about what\n\nit throws away.\n\nAn approval and an edit are different events. If a reviewer changed the draft\n\nbefore approving it, then the thing that went out is not the thing the agent\n\nproduced, and the difference is the most interesting part of the record. It is\n\nwhere the human judgment actually lives.\n\nSo the record needs the agent's output as an artefact, and the human's\n\nintervention as an override that carries the diff, the reviewer's rationale, and\n\na flag for whether the edit refined the agent's intent or replaced it. Refining\n\nand substituting are different signals: one says the agent was roughly right, the\n\nother says it was wrong. Aggregate a few hundred of those and you have an honest\n\nmeasure of where the agent is failing, which is a byproduct of the audit trail\n\nrather than a separate analytics project.\n\nRejections and escalations matter too, and for the same reason. A record that\n\nonly preserves the decisions that went through preserves the successes and\n\ndiscards the disagreements, which is precisely backwards from an accountability\n\npoint of view.\n\nA decision record that the system producing it can quietly edit is not evidence.\n\nIt is a claim.\n\nThe fix is old and well understood: sign each record, and chain it by content\n\nhash so each entry commits to the one before it. Change any entry after the fact\n\nand every subsequent link breaks. A verifier can then re-walk the chain and say\n\nwhether it is intact, without trusting the system that produced it.\n\nFor the strongest form, that chain can be anchored in an external transparency\n\nlog. This is what the IETF's SCITT work is for, and it means a relying party can\n\ncheck a decision happened without asking either party involved. We have an\n\noptional profile for it, and we have been discussing the details on the SCITT\n\nmailing list, where several implementers pointed out things we had wrong. More on\n\nthat in a moment, because it is the most useful part of this post.\n\nCHAP is our attempt at this layer. It is an open protocol, Apache-2.0, and it\n\nrides on MCP and A2A as transport rather than competing with them.\n\nThe Python coordinator has no runtime dependencies, so the fastest way to see\n\nwhat a decision record looks like is to run one of the worked scenarios straight\n\nfrom a clone, with nothing installed:\n\n```\ngit clone https://github.com/BrightbeamAI/chap\ncd chap/scenarios/02-marketing-copy\npython3 scenario.py\n```\n\nThat scenario runs a small marketing workflow with one drafter and one editor. It\n\nprints the chain, verifies it, tampers with a copy to show the verification\n\nfailing at the exact entry, reconstructs a single edit with its diff and\n\nrationale, and reports which kind of override the editor kept making. The whole\n\nthing is deterministic, so you get the same output every time and can read the\n\nscript to see exactly what produced it.\n\nIf you would rather wire it into something, the coordinator and the framework\n\nbridges are published:\n\n```\npip install chap-coordinator\npip install chap-langgraph        # or chap-pydantic-ai, chap-llama-index, chap-ag2, chap-google-adk\nnpm install @brightbeamai/chap-coordinator\nnpx -y @brightbeamai/chap-coordinator-mcp   # expose CHAP as MCP tools\n```\n\nThis is the part worth reading if you are building anything similar, because\n\nthese were not obvious to us and most of them came from other people.\n\n**Adapters must not infer decisions.** Our first bridges tried to be helpful.\n\nIf a framework's human-input hook returned an empty string, that looked like\n\nassent, so the bridge recorded an approval. It also joined the reviewer as a\n\nhuman participant regardless of what identity the caller supplied. Both are\n\nunforgivable in a record whose entire purpose is attributing a decision to a\n\nperson. An adapter that guesses is manufacturing evidence. Now an explicit\n\ndecision is required, unknown identity schemes are rejected rather than assumed\n\nto be human, and a bot cannot be recorded as a human approver.\n\n**An override must diff against the artefact under review.** Ours originally\n\ntook the \"before\" value from the caller. That let a reviewer record an override\n\nagainst a document that was never actually reviewed, which makes the diff a\n\nfiction while leaving the rationale and the signature perfectly valid. The base\n\nnow always comes from the coordinator's own record of what was sent for review.\n\n**Reading a log should not change it.** For a while, calling the audit read\n\nmethod appended an entry to the audit chain, which meant inspecting the log\n\naltered it, and so did verifying it. Obvious in hindsight, invisible in practice\n\nuntil somebody looked.\n\n**Two implementations will disagree about bytes.** We have a TypeScript\n\ncoordinator and a Python one, and they hash records identically, except that\n\nPython sorts object keys by code point and the JSON canonicalisation standard\n\nsorts by UTF-16 code unit. For any key outside the basic multilingual plane the\n\ntwo produce different canonical bytes, and therefore different hashes for the\n\nsame object, which quietly breaks cross-implementation verification. If you have\n\ntwo implementations of anything hash-based, test them against each other with\n\nawkward input.\n\n**Integrity checks cannot see a record that was never written.** This one came\n\nfrom another implementer on the SCITT list, who has operated a public transparency\n\nlog and found four cases of it. Chaining and signing prove that the records you\n\nhold are intact. They say nothing about a record that failed to be created, and a\n\nchain of signed links reads identically whether an approval never happened or\n\nhappened and was lost. For a human oversight trail that distinction is the whole\n\nballgame. The fix is ordering rather than cleverness: admit the record first, and\n\nmake the decision's success conditional on it.\n\nCHAP is at 0.2.10, with two reference implementations that answer the same\n\nconformance suite identically, eleven composable profiles, bridges for the five common agent frameworks, and a first external integration from a team building an execution authority layer, which is currently experimental.\n\nThe recent releases have been almost entirely security and audit hardening driven by outside review, which is the argument for doing this in the open. Every item in the section above was either found by somebody else or found by us because somebody else asked a sharp question.\n\nIf you are building agents that take consequential actions, the questions worth asking are the same whether or not you use any of this. Can you produce the record of a single human decision without disclosing the others? Does your override bind to the exact artefact it overrode? Can you tell the difference between no approval and a lost approval?\n\nIf you want to pull at any of it, the spec, the scenarios, and the conformance harness are at [github.com/BrightbeamAI/chap](https://github.com/BrightbeamAI/chap), and issues are genuinely welcome, including the ones that tell us we have this\n\nwrong.", "url": "https://wpnews.pro/news/your-agent-asked-for-approval-where-did-the-answer-go", "canonical_source": "https://dev.to/arsalan_shahid116/your-agent-asked-for-approval-where-did-the-answer-go-47m8", "published_at": "2026-08-20 22:58:33+00:00", "updated_at": "2026-08-20 23:43:54.981787+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy", "ai-infrastructure"], "entities": ["Model Context Protocol", "A2A", "Kang", "Diponegoro", "IETF", "SCITT"], "alternates": {"html": "https://wpnews.pro/news/your-agent-asked-for-approval-where-did-the-answer-go", "markdown": "https://wpnews.pro/news/your-agent-asked-for-approval-where-did-the-answer-go.md", "text": "https://wpnews.pro/news/your-agent-asked-for-approval-where-did-the-answer-go.txt", "jsonld": "https://wpnews.pro/news/your-agent-asked-for-approval-where-did-the-answer-go.jsonld"}}