AI 竞赛中被忽视的问题：我们能否解释 Agent 已经做了什么？

The public conversation around advanced AI often collapses into two positions. One side says we should slow down. The other says progress is inevitable, so we should accelerate and compete. Both arguments matter. But teams deploying AI agents today face a more immediate problem: Can we explain what the agents already did inside our own environments? That question is less dramatic than the future of superintelligence. It is also more operationally urgent. AI coding assistants and autonomous agents are no longer limited to suggesting text in a chat window. They can inspect repositories, execute commands, call tools, modify files, use credentials, interact with ticketing systems, and reach external services. Once that happens, "we have a policy" is no longer enough. A team needs to be able to answer basic questions after an incident, review, or audit: What was the original request? Which tools did the agent use? What happened between the prompt and the final answer? Which files or systems were changed? Was a risky action approved? Did a person review the result? Can someone else reconstruct the sequence later? The important word is not logging. It is causality. A repository might show that a file changed. A chat transcript might show that someone asked for help. An access log might show that a credential was used. But those records often do not explain how the events connect: Which agent action led to this command, which led to this file write, under which user request, with which approval? That missing chain is where accountability disappears. This is not an argument for blocking every action Human checkpoints matter, especially for irreversible or high-impact actions. But prompting a person for approval on every operation creates its own failure mode: approval fatigue. Anthropic has written publicly about this tradeoff. Its experience with agent permissions found that people approved the overwhelming majority of prompts, making constant confirmation an unreliable safety mechanism by itself. Their focus is increasingly on technical containment: constraining what an agent can do through boundaries such as sandboxes, virtual machines, and egress controls. Read Anthropic's discussion. The point is not to eliminate human review. It is to reserve it for the moments where it matters, then preserve evidence that the review happened. Governance needs two layers A useful operating model has two distinct layers. Preventive controls constrain what an agent can do: scoped credentials, network boundaries, sandboxes, policy enforcement, and approval gates. Detective controls preserve what the agent did: requests, tool calls, results, files changed, timestamps, decisions, approvals, and evidence of review. One without the other is incomplete. Preventive controls can reduce harm, but they cannot explain an action later unless the decision itself is recorded. Logs can support an investigation, but they cannot prevent an agent from reaching a system it should never have been allowed to access. This is why the conversation should not be "governance versus innovation." Good governance is part of what lets teams adopt useful agents with confidence. OpenAI's own discussion of safely operating coding agents describes the same ingredients: technical boundaries, approval decisions, agent-aware telemetry, and the ability to inspect the original request, tool activity, results, and policy decisions when something needs review. Read OpenAI's approach. Build the evidence trail before you need it The worst time to ask how an AI agent acted is after something went wrong. By then, the prompt may be gone, the context may have been compacted, tool output may have changed, and the person who ran the session may not remember why a decision was made. Evidence is cheap to preserve at the moment of action and expensive to reconstruct later. That is the problem Chron is built around. Chron is a local-first audit trail for AI-assisted work. It records AI sessions and their events, maintains evidence integrity locally, and helps teams find the sessions that warrant review. It does not certify compliance or replace a human auditor. It gives teams a more defensible starting point: a record of what occurred. The argument about how quickly AI should progress will continue. In the meantime, organizations should make sure that the AI already acting in their codebases and environments is not operating in a black box. Because the question after an incident will not be: "Was the model powerful?" It will be: "What did it do?" Chron has passed 8,852 downloads. It is still early, local-first, and free to try: npm install -g chron-mcp Enter fullscreen mode Exit fullscreen mode