Three layers, and what each one can actually state
Identity platforms establish authority.
They can tell you which agent was allowed to act, on whose behalf, and with what entitlement. They are never on the connection between the agent and the data.
Agent platforms establish the claim.
They can tell you which tool was invoked and with what arguments. What came back is a self report, and result payloads are truncated by design, so the size and shape of what was returned is not in the record.
We establish the fact.
The statement as executed, the rows that came back, the columns that were read. Produced by something the agent does not control and cannot switch off.
Evidence
This is the artifact, not a dashboard screenshot.
record sv_01J8F2K9QX4M observed 2026-08-19T14:02:17.443Z agent agent-billing-assistant platform: entra-agent-id session sess_7f3a9c chain position 41 of 41 statement SELECT id, name, ssn, dob, plan_id FROM members WHERE region = $1 parameters $1 = 'WEST' returned 40247 rows columns id name [PII] ssn [SENSITIVE] dob [PII] plan_id policy allowed, flagged: result set above session threshold signature ed25519 verified chain intact
Synthetic example with illustrative field names and values.
What the record does not establish
The record shows what an agent read and changed. Whether that access was appropriate remains a policy and risk judgment.
Why the second connection is the one that matters
Identity and policy operate on the connection between the agent and the tool server. The query, row count and column list exist on the connection between the tool server and the database. Holding both records for one event produces reconciliation.
Where this shows up in practice
Incident scoping.
When something goes wrong, the first question is what data was reached. An answer built from a self report and a truncated payload cannot bound it, and an unbounded scope becomes a broad notification.
Vendor and customer assurance.
When a customer asks what your agent touched inside their data, a signed record answers it and a written attestation restarts the conversation.
Internal approval.
The team that has to sign off on production access is being asked to accept a risk whose consequence nobody can currently measure.