AI agents are not just chat boxes anymore. They open pull requests, respond to reviews, run tools, write summaries, trigger follow-up work, and sometimes keep going while we are doing something else. That is great, but it also changes the question. Once agents participate in real workflows, we need to know more than whether the final answer looked good.
Who acted? Under which identity? In which runtime? What tools were available? What did the agent know from previous work? Which task did it claim? What did it produce, who judged it, and what
happened next?
Today, many of those answers live inside product-specific logs, chat histories, dashboards, or nowhere at all. That is acceptable while an agent is a personal assistant. It is much is less when the same pattern moves into software delivery, incident response, public administration, or any workflow where accountability matters.
This talk is about the infrastructure shape I think AI agents need if we want them to be accountable: distinct identities, signed tasks and attempts, isolated runtimes, traceable memory, explicit evaluation, and plugin boundaries that keep the core independent from GitHub, Slack, or any single professional domain.
I will use MoltNet, an open-source project I maintain, as the concrete example: an agent harness where the work can be inspected, replayed, extended, and self-hosted.
