The Autonomous Action Record
What an AI workforce must record every time it decides something: written before the outcome is known, with three outcome states rather than two, and refusals logged with the same weight as actions.
Version 0.1, draft, in use, published 2026-08-11. What an AI workforce writes down every time it decides something, including the times it decided not to.
This format is already in use, which is unusual for a specification on this site. tools/pilot_observe.py writes a record before every decision it makes, and the only records that exist so far are REFUSALS: the control plane declining to observe a live system outside the window its constitution permits. That is the format working, and it is also the smallest possible demonstration of it.
Why self-documenting is not automatically trustworthy
The roadmap asks for self-documenting IT and describes the benefit correctly: nobody spends Friday afternoon updating documentation. The part it does not say is that documentation generated by the thing being documented is only trustworthy if it cannot be written selectively. A system that records its successes and drops its refusals produces a log that reads beautifully and proves nothing, and it will be believed precisely because it is machine-written.
So this format is built around one rule: the record is written BEFORE the outcome is known.
The rule everything else depends on
A record is created at the moment of DECISION, not at the moment of completion. It therefore exists for actions that were refused, for actions that failed, and for actions that started and never resolved. Writing at completion means the log contains only what completed, and the gap is invisible because there is nothing there to see.
What a record carries
| Field | Why |
|---|---|
ts | When the DECISION was taken. Not when the action finished, which is a different moment and is the one a completion-time log silently records instead. |
actor | Which agent or component decided. An action attributable to 'the system' is attributable to nobody. |
action | The action name as it appears in the governing constitution, so a record can be matched to the clause that permitted or refused it. |
target | The specific system, not the class of system. 'Production' is not a target. |
decision | permitted, refused, or escalated. Refusals are records, not absences. |
clause | The clause that decided it. A refusal citing no clause is an opinion, and a permission citing no clause is unauthorised. |
authority | Who or what authorised it: an automatic clause, a named approver role, or an owner. This is the field a regulator asks for and the one an autonomous system is most likely to leave empty. |
ok | THREE states, not two. 1 done, 0 refused, -1 started and never resolved. A hung call must not be indistinguishable from a refusal, and two states force exactly that confusion. |
reversal | How this was or would be undone, recorded at decision time. A rollback plan written after something goes wrong is a plan written under pressure. |
evidence | What was observed to conclude the action worked. Verification that checks the action completed rather than that the problem is gone proves nothing. |
Rules
- The record is written BEFORE the action is attempted. Everything else in this format depends on that one ordering.
- `ok` has three states. A record left at -1 is a real finding: something started and nobody knows how it ended.
- A refusal is recorded with the same weight as an action. A control plane whose log contains only what it did cannot show what it prevented, which is the entire value of having one.
- Records are append-only. A corrected record is a new record referencing the old one, never an edit, for the same reason the frozen forecast cannot be quietly rewritten.
- No record contains customer data. It names the system, the action and the clause; it does not carry rows, credentials or personal information, and a record that would need them to be useful is describing an action that should not be automatic.
- Aggregates over records state refusals and failures alongside successes. A summary reporting only completions is the selective log this format exists to prevent.
The first records this format ever produced
Real entries, not a worked example.
| Decision | Reason | Clause | ok |
|---|---|---|---|
| refused | constitution not in force | none | 0 |
| refused | window limit | observation-window | 0 |
Both are refusals, and the first thing this format ever recorded was the control plane declining to touch a live system. A log that began with a success would have been less informative.
How this format gets gamed
- Writing the record at completion, which is the default in every logging library and produces a log of successes with invisible gaps.
- Two states instead of three, so a hung action is filed as a refusal and the system looks more decisive than it is.
- An `authority` field filled with the name of the system itself, which is a machine authorising its own action and reads as governance.
- Evidence that restates the action: 'restarted the service, service restarted'. Verification must test the symptom, not the remedy.
- A dashboard built only over successful records, which is the selective log arriving one layer up.
Questions to ask
- Is the record written before the action or after it?
- How many states does your outcome field have, and how do you tell a hung action from a refused one?
- Show me a refusal in the log. If there are none, what is the policy for?
- What does the authority field contain when the action was automatic?
- Does your verification test the symptom or the remedy?
- Can a record be edited after it is written, and by whom?
Status
Version 0.1, draft, and in use by one component against one system. It becomes a standard when somebody outside this company logs against it and tells us which field they could not fill.
Everything here is free and stays free. There is no form in front of any document. If you want to know when new guides and templates go up, leave an email.
Roughly monthly. Unsubscribe in one click. We do not share your address, and we will not call you.