Authorization Logs Are Not Compliance Evidence: The Article 9 Gap in Agent Harness Security
Year: 2026
Type: preprint
Abstract: The EU AI Act Article 9 requires high-risk AI providers to establish and maintain a continuous, iterative risk management lifecycle — identifying foreseeable risks, adopting targeted mitigations, and producing documented evidence across the system lifecycle. Agentic AI systems, where autonomous agents execute multi-step tasks via tool calls, present a distinct compliance challenge: their security layer produces authorization decision logs, but not the structured evidence artifacts Article 9 requires. We conduct a systematic gap analysis of five harness security products and three policy engine implementations against Article 9's explicit evidence requirements. We find that all evaluated products emit raw authorization logs suitable for debugging and audit, but none produce the structured evidence artifacts required for continuous risk management. We characterize the gap, define the mapping from authorization decision logs to Article 9 evidence artifacts, and propose an architectural pattern — the Article 9 Evidence Adapter — that bridges the two.Note: This is a structured research outline establishing priority. Full paper in preparation.
Author: Just, Pavol
Language: English
Topic: Access Control and Trust
Subfield: Sociology and Political Science
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W7201843513
Cites:
Cited by:
Related to: