文章背景与核心概要

随着大语言模型（LLM）智能体被赋予调用工具、查询数据库、委派任务以及触发外部副作用的自主权，安全领域的核心焦点已不仅局限于如何单纯防范有害行为，更延伸至确保这些行动在部署后具备可追溯的责任答辩能力。本文深入探讨了这一关键命题，系统性地构建了智能体可审计性（Auditability）的基础框架。

论文的核心贡献在于明确区分了责任性（Accountability）、可审计性（Auditability）和审计（Auditing）三个概念，并提出了“没有可审计性，系统就无法实现真正的责任性”这一核心论点。为了使该理论框架具备实际操作价值，作者定义了智能体可审计性的五个核心维度以及三大类底层机制，并通过生态系统测量、运行时可行性测试以及控制恢复实验对理论进行了多维验证。最后，文章提出了用于评估智能体系统的“可审计性卡（Auditability Card）”，并指出了该领域未来亟待解决的六大开放性研究问题。

Auditable Agents

Summary

As Large Language Model (LLM) agents gain the autonomy to call tools, query databases, delegate tasks, and trigger external side effects, the primary security concern extends beyond merely preventing harmful actions to ensuring that those actions remain answerable after deployment.

This paper—"Auditable Agents"—introduces a foundational framework differentiating accountability, auditability, and auditing, while asserting that an agent system cannot be truly accountable without robust auditability. To make this operational, the authors define five core dimensions of agent auditability and three mechanism classes. Supported by ecosystem measurements, runtime feasibility tests, and recovery experiments, the paper concludes with the introduction of an Auditability Card and outlines six open research problems.

As Large Language Model (LLM) agents gain the autonomy to call tools, query databases, delegate tasks, and trigger external side effects, the primary security concern extends beyond merely preventing harmful actions to ensuring that those actions remain answerable after deployment.

This paper—"Auditable Agents"—introduces a foundational framework differentiating accountability, auditability, and auditing, while asserting that an agent system cannot be truly accountable without robust auditability. To make this operational, the authors define five core dimensions of agent auditability and three mechanism classes. Supported by ecosystem measurements, runtime feasibility tests, and recovery experiments, the paper concludes with the introduction of an Auditability Card and outlines six open research problems.

Paper Metadata

Field	Details
arXiv ID	arXiv:2604.05485 [cs.AI]
Subjects	Artificial Intelligence (cs.AI)
ACM Classes	I.2.11; K.6.5; D.2.4
Authors	Yi Nian, Aojie Yuan, Haiyue Zhang, Jiate Li, Li Li, Xiyang Hu, Hua Wei, Xiongye Xiao, Chaowei Xiao, Yue Zhao
Timeline	Submitted on 7 Apr 2026; Last revised 13 Aug 2026 (v2)
Comments	24 pages, 1 figure. Extended version. A condensed 4-page version appears in the Proceedings of the ACM AI Leadership Summit 2026 (Visionary Papers track).
DOI	10.48550/arXiv.2604.05485

Abstract

LLM agents call tools, query databases, delegate tasks, and trigger external side effects. Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented—it is whether those actions remain answerable after deployment.

We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property that makes accountability possible), and auditing (the process of reconstructing behavior from trustworthy evidence). Our claim is direct: no agent system can be accountable without auditability.

To make this operational, we define five dimensions of agent auditability: 1. Action recoverability 2. Lifecycle coverage 3. Policy checkability 4. Responsibility attribution 5. Evidence integrity

We also identify three mechanism classes (detect, enforce, recover) whose temporal information-and-intervention constraints explain why, in practice, no single approach suffices.

We support the position with layered evidence rather than a single benchmark: * Ecosystem measurements: Lower-bound measurements suggest that even basic security prerequisites for auditability are widely unmet (617 security findings across six prominent open-source projects). * Runtime feasibility: Pre-execution mediation with tamper-evident records adds only 8.3 ms median overhead. * Controlled recovery experiments: Responsibility-relevant information can be partially recovered even when conventional logs are missing.

Finally, we propose an Auditability Card for agent systems and identify six open research problems organized by mechanism class.

LLM agents call tools, query databases, delegate tasks, and trigger external side effects. Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented—it is whether those actions remain answerable after deployment.

We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property that makes accountability possible), and auditing (the process of reconstructing behavior from trustworthy evidence). Our claim is direct: no agent system can be accountable without auditability.

To make this operational, we define five dimensions of agent auditability: 1. Action recoverability 2. Lifecycle coverage 3. Policy checkability 4. Responsibility attribution 5. Evidence integrity

We also identify three mechanism classes (detect, enforce, recover) whose temporal information-and-intervention constraints explain why, in practice, no single approach suffices.

We support the position with layered evidence rather than a single benchmark: * Ecosystem measurements: Lower-bound measurements suggest that even basic security prerequisites for auditability are widely unmet (617 security findings across six prominent open-source projects). * Runtime feasibility: Pre-execution mediation with tamper-evident records adds only 8.3 ms median overhead. * Controlled recovery experiments: Responsibility-relevant information can be partially recovered even when conventional logs are missing.

Finally, we propose an Auditability Card for agent systems and identify six open research problems organized by mechanism class.

Access & Links

• Full-Text Access: View PDF | HTML (Experimental) | TeX Source
• Citations & References: Google Scholar | Semantic Scholar | NASA ADS

• Full-Text Access: View PDF | HTML (Experimental) | TeX Source
• Citations & References: Google Scholar | Semantic Scholar | NASA ADS