The limit of the final output
An artificial intelligence system that merely generates text leaves behind a trail that is relatively simple to examine: the response it produces. According to the analysis published by Agenda Digitale, this approach becomes insufficient when the AI is agentic—that is, when it queries repositories, uses credentials, invokes tools, and interacts with applications, producing effects in the external world. In that case, the final output alone does not explain what happened.
The source instead proposes reconstructing a structured sequence: assigned objective, system and user instructions, retrieved context, memory, configuration, identity, delegations, authorizations, tool calls, service responses, and changes actually recorded in the recipient systems. This is the evidentiary chain that the article identifies as the new object of forensic work.
Operational capability, not commercial labels
The article urges not to stop at the name used by the vendor: a system may be presented as an assistant, copilot, or agent, but what matters technically is the degree of operational capability. A chatbot receives an input and returns content; an agentic system, by contrast, combines a generative model, an orchestrator, session state, memory, dynamically retrieved sources, control rules, and action tools.
Autonomy, the source specifies, is not absolute and may be limited, supervised, or subject to human confirmations. However, the possibility remains that between the initial instruction and the result a path may develop that is not entirely predefined, made up of multiple calls to the model, failed attempts, corrections, handoffs to other agents, and actions carried out by external services. For this reason, a screenshot of a conversation is described as only the visible surface of a broader process, and the suggested unit of analysis is not the individual message but the execution as a whole.
Attribution and distributed sources
Evidence concerning an agent is normally distributed across multiple infrastructures: the orchestration platform, the model provider's logs, identity and access systems, invoked services, and the user's device. The article also cites OpenTelemetry semantic conventions for GenAI, which provide attributes such as agent identifier and version, system instructions, retrieved data, tool call identifier, arguments, and result. However, this is telemetry born for observability, security, and diagnosis: it may be incomplete, sampled, or subject to different retention policies and does not automatically constitute forensic evidence.
On the attribution level, the source distinguishes four elements: user identity, agentic instance identity, credential used, and scope of delegation. A valid token proves that a request was authenticated, but does not by itself prove who intended it, whether it fell within the authorization granted, or whether the credential was misused. The article flags the case of actions on behalf of third parties, in which an agent may have privileges higher than those necessary.
