Replay Is Not Enough: The Evidence Gate for Professional AI

October 9, 2026ANUNNAKI MATRIX (Pty) Ltd

New research on tool using agents reinforces a simple requirement for consequential professional work: the system must prove not only what happened, but that each action was supported by valid, in scope evidence when it happened.

Replay answers an essential question after professional work is completed: what happened, under which authority, using which evidence, and with what result? New research on tool using AI agents adds a sharper requirement. A record of an action is not enough if the system was permitted to act without the evidence required for that action.

For consequential professional work, a trustworthy system needs two controls working together. The first is Replay: an independent reviewer can reconstruct the result from the admitted inputs, governing version, authority, receipt and successor state. The second is an evidence gate: before an action or conclusion is allowed, the system must test whether the required evidence is present, current, uncontradicted and within scope.

A system should not merely explain an action after the fact. It should be unable to take that action when its required evidence has not been established.

The problem: plausible work can still be unsupported

From Evidence to Action: How Tool Using Agents Fail, released on 6 October 2026, examines 656 cases across six operational domains. The authors find that agents can still take consequential actions after investigation is incomplete. In their evidence withholding tests, agents continued to act in 46.5 to 53.5 percent of completed episodes even though the evidence necessary to support the action was unavailable.

This matters because a professional output can look polished, a tool call can succeed and an activity log can look complete while the underlying condition for acting was never established. More information seeking did not reliably result in more restraint. The safety boundary has to be enforced independently of the language model's own confidence or explanation.

For a Professional Anunnaki Twin, this means that an evidence list attached to a result is not enough. Each material claim and action needs declared evidence requirements. The active evidence must then be checked against those requirements before the Professional Anunnaki Twin may proceed.

What the evidence gate must test

Identity and source. Is this evidence tied to a known person, system, authority or record, and can its origin be verified?
Scope. Does it relate to this professional, enterprise, matter, role, jurisdiction and purpose?
Currency. Is it still valid, or has its expiry, review date or underlying condition passed?
Completeness. Are all mandatory records, approvals, controls or observations present?
Consistency. Does the evidence conflict with another admitted record, instruction or current state?
Authority. Does the evidence support the specific action proposed, or does the action remain reserved for a human professional?

If any required condition is not met, the correct result is not a confident answer with a warning. It is a declared state: WAIT REPAIR, RESERVED or REFUSED, together with the Necessary Work required to make progress lawful and reviewable.

Completion must be a certificate, not a sentence

A second paper, When May an Agent Stop? Evidence Carrying Termination for Tool Using LLMs, proposes that an agent may report completion only when a typed certificate binds every required claim to valid, in scope trace evidence and a deterministic replay reconstructs the claimed result. Its reported results are from controlled synthetic tasks, not proof that an agent has discovered external truth. That limit is important.

But the architecture is directly useful. A Professional Determination should not become complete because a model has written a conclusion. It should become complete only when a Determination Completion Certificate verifies:

the exact claims or actions being concluded;
the supporting evidence identifiers and their validity at the point of use;
the profession, jurisdiction, role and authority boundary in force;
the rules, method and canonicalization version applied;
the expiry horizon and any unresolved conditions;
the receipt chain, result and deterministic replay outcome.

This is stronger than a generic audit trail. It enables an authorised third party to inspect whether the conclusion was supported under the conditions that existed at the time, rather than merely seeing that the system produced a conclusion.

Replay proves reproducibility, not truth by itself

Replay is still non negotiable. A replayable result can show that the same canonical inputs, rules and code produce the same outcome. It can show that a receipt has not been altered. It can expose a changed input, a changed ruleset, a missing artifact or an invalid signature.

It cannot by itself prove that the original evidence was complete, that its source was authoritative, or that the selected rules were appropriate for every real world condition. Those are distinct controls. The professional and independent reviewer remain responsible for the questions that must be decided by people.

This distinction is reinforced by Agent Evaluation Reliability: More Tasks Won't Always Fix an Agent Leaderboard. The paper argues that evaluation reliability depends on the particular claim being made. A score can be useful for one purpose, such as comparing a particular deployed setup, without proving an absolute capability or reliability claim in every context.

Anunnaki.Live should therefore keep a clear separation between a Determination Receipt and an Evaluation Report. A receipt records one governed result. An evaluation report records the precise engine build, canonicalization version, test corpus, harness, repetitions, coverage and limitations supporting a performance claim. Neither should be used as a substitute for the other.

Memory is not evidence unless it can be verified

Persistent agent memory is another pressure point. The October 2026 IETF Internet Draft on AI Agent Memory Integrity proposes controlled tests for altered, removed, reordered, replayed and forged memory. It is a work in progress, not a standard, but it identifies the right practical threat: an agent can treat stored context as if it were its own reliable experience.

A Professional Anunnaki Twin should distinguish non evidentiary working context from admitted evidence. Memory may help retrieve, organise and prepare work. It may not silently become proof. Evidence used in a determination must remain identifiable, versioned, scoped and independently inspectable.

Portable proof needs canonical boundaries

Two IETF proposals also show where the wider ecosystem is moving. TIBET describes cryptographically linked, append only provenance trails across agents, people and automated processes. The Agentic Reasoning Protocol combines Ed25519 signatures, JSON Canonicalization Scheme and DNS based authority verification for machine readable claims.

These are drafts, so they should not dictate an internal architecture. They do, however, reinforce two design disciplines: preserve a frozen internal canonical form for replay, and provide a carefully tested bridge when proof objects leave the system. Canonical bytes, Unicode treatment, numeric representation and signature test vectors must be proven at the boundary. They must never be assumed.

The operating standard for Professional Anunnaki Twins

No conclusion beyond the admitted evidence.
No action beyond the active professional and enterprise boundary.
No completion without a machine checkable evidence scope certificate.
No silent reliance on stale, altered or unverified memory.
No claim of reliability without a versioned, reproducible evaluation record.
No material result that an authorised independent party cannot replay and inspect.

This does not make every professional judgment automatic, and it should not. The purpose is to make the boundary visible: what is established, what remains latent or silent, what has been refused, what must return to a human professional and what Necessary Work is required next.

The important shift is from AI that gives an answer to governed professional work that can prove its basis. Replay remains the operating layer of trust. The evidence gate is what stops Replay from becoming a perfect reconstruction of an unsupported action.

Research status and sources

The academic sources below are recent preprints and the protocol sources are Internet Drafts. They are valuable design evidence but not settled standards, peer reviewed proof or validation of ANUNNAKI Mathematics or God Code. They inform the engineering assurance layer around determinations.