When an AI Agent Skips a Step, Your Audit Log Shows a Clean Run

Every other failure leaves something behind. A hallucination leaves a wrong answer you can read. A crash leaves a stack trace. A breach trips an alarm. Each of them puts an object into the world that somebody can pick up and argue about. A skipped step puts nothing into the world, and nothing is indistinguishable from correct. Your audit log does not fail to catch it. Your audit log vouches for it.

The failure that certifies itself

A log records events. A step that did not happen is not an event, so it writes no line. Steps 1, 2 and 4 read as 1, 2, 3 to anyone who did not already know a 4 was owed.

So the trail does not report a gap. It reports continuity. An auditor reads it, reasons correctly from the evidence in front of them, and arrives at the wrong answer. The instrument of assurance has become an instrument of false assurance, and it does this while working exactly as designed.

Cryptography does not save you here, and this is the part people get wrong. Hash-link your log, sign every entry, chain each record to its predecessor. Now the log is tamper-evident, and the chain over the steps that did run is perfectly intact, because nothing was tampered with. There was never a record to alter. You have made a complete, verifiable, beautifully signed account of an incomplete run, and made it more convincing in the process.

Agents skip steps, and handing them the procedure makes it worse

The reflex is to specify the workflow. That has been measured. FlowBench (EMNLP 2024 Findings) put LLM agents through 51 scenarios across six domains and classified every session failure by type. Type 1 is missing steps: the agent skipped required task steps.

Giving the agent the procedure did not reduce omissions in any format tested. It raised them. Sequencing and transition errors improved, which is what the paper leads with. The omissions went the other way, in the same table.

A separate analysis of 16,991 agent trajectories found the same behaviour from the other side: without an explicit plan, agents fall back on workflows internalised during training that are frequently incomplete, and when the instructed order was deliberately rearranged, models ran the phases in their own preferred order regardless.

These are not edge cases or jailbreaks. This is what the systems do on an ordinary day, and more than half the time something goes wrong, what went wrong is that a step did not happen.

So you put a human in the loop. The human is not a control.

The second reflex is a person who checks. Clinical informatics has been measuring exactly that arrangement for two decades, because medicine wired verification prompts into prescribing systems long before anyone had an AI agent to worry about. It is the largest body of evidence in existence on whether humans actually perform a verification step that software puts in front of them.

They do not. A 2024 systematic review and meta-analysis of 16 studies found an override rate of 90%, with a 95% confidence interval of 85 to 95%.

Note what that survived. The review reports the rate staying high after systems were tuned to cut alert volume. Fewer, better prompts did not fix it, in the same way a better-specified workflow did not fix the agents. Both interventions target attention, and attention is not the binding constraint.

A human approval step is a control on paper. Wherever anyone has bothered to measure it, it is not a control in fact, and the record it leaves behind is identical either way.

A regulator has already decided you do not need to know

In July 2025 the US Centers for Medicare & Medicaid Services published its guidance on signature requirements for medical records. On page two it addresses what happens when software writes the note.

“If you use a scribe, including artificial intelligence technology, sign the entry to authenticate the documents and the care you provided or ordered. You don't need to document who or what transcribed the entry.”

CMS, MLN905364, July 2025, p.2

That document is four pages long. Within them it finds room to specify that a rubber-stamp signature is permitted only where a practitioner has a physical disability and provides proof, under the Rehabilitation Act of 1973, and that using the stamp certifies the provider has reviewed the document. It finds room to require that a medical student's entry be reviewed, verified, signed, dated and kept attributable to the student.

That is fine-grained attention to attribution and to what a signature certifies. On whether a machine wrote the clinical record: no requirement at all.

The precision is entirely on one side. A document with that much to say about payment attribution and nothing to say about machine authorship is not failing to notice. It is telling you what it was built to care about.

The consequence is small and total. A clinician who reads a generated note, catches an omission, corrects it and signs produces the same artefact as a clinician who clicks sign. Same field, same timestamp, same authentication. No system records time on the note, whether anyone scrolled, whether the source was opened, or whether a character changed. The question “was this checked?” is not unanswered. It is unanswerable.

This is running right now, at national scale

Ambient AI scribes are being deployed across New Zealand's public hospitals: 27 hospitals, around a thousand emergency clinicians, a hundred mental health crisis teams, with a stated goal of every hospital by the end of 2026. The pilot results are good. Documentation fell from roughly seventeen minutes per patient to just over four.

Sit with that number, because it is the whole problem in one figure. A saving that size is only available if the note is not read closely. The measured benefit and the verification step are competing for the same thirteen minutes, and nothing in the record shows which one won on any given patient.

New Zealand has its own rule here, and it is stricter in intent than the American one. Rule 8 of the Health Information Privacy Code 2020 is titled Accuracy, etc, of health information to be checked before use or disclosure:

“A health agency that holds health information must not use or disclose that information without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant and not misleading.”

Health Information Privacy Code 2020, Rule 8(1)

The word checked is in the rule's own heading. This is a code of practice under the Privacy Act 2020, so it binds.

And it cannot be enforced. Whether reasonable steps were taken to check a generated note before it entered a record other clinicians will rely on is precisely the fact no system retains. The rule is not weak. It is unauditable, because the evidence needed to test it was never required to exist.

Detection and prevention are different jobs

None of this is a new idea. Business process auditing has had a technique for it for twenty years, called conformance checking: declare the process in advance, compare the log against that declaration, and the comparison reports what is missing. It works, and it depends entirely on the declaring. Absence is only visible against a specification of presence.

What it cannot do is act. It reads the log afterwards and reports what went wrong, which is an autopsy: the step is already missing, the note is already in the record, the payment has already gone out. And it only finds a missing step if that step would have been an event in the log to begin with. Reading a note before signing it is not an event in any system.

Move the comparison forward in time and the problem changes shape. Declare the sequence before the run starts. Check each step against it before that step executes, and refuse the ones that do not belong. The run then produces its evidence as a by-product of being enforced, rather than as an account written afterwards by the same process you are asking about.

That is what AgenticRail is: a declared step order, ALLOW or DENY before each step, a signed receipt per decision hash-linked to its predecessor, and a run that closes at the final step and cannot be reopened without leaving a detectable break in the chain. Verify any of it yourself, without asking us anything.

Go and look at whatever you are running today. Pick the step that would matter most if it were missed, and ask what artefact would exist if it had been skipped. If the answer is none, you do not have an audit trail of that process. You have a log, and a log is always complete with respect to itself.

Related reading: Orchestration vs Enforcement · AI Agent Audit Log Best Practices · Provable Human Oversight · Completeness Specification