A wave of good companies is solving a real problem. Machine identities outnumber humans in the enterprise by orders of magnitude, secrets leak, and agentic AI is about to make it far worse. The answer taking shape is runtime access control: discover every non-human identity, kill the static secrets, and issue short-lived, policy-based credentials at the moment of use. It is a genuine improvement, and every serious security team should be moving toward it.

But controlling access answers one question: is this agent allowed to act? It says nothing about the question you will actually be asked later: what did it do, and can you prove it?

Allowed is not the same as accountable

An agent can be perfectly authorized and still do something you never intended. It can be granted access to a database and exfiltrate the wrong rows. It can be permitted to send email and send the wrong one to the wrong party. Access control was satisfied at every step. The damage happened anyway, inside the lines you drew.

When that happens, "the agent was authorized" is not a defense. It is an admission. What you need is a record of exactly what the agent did, one that holds up when someone who does not trust you is reading it.

The gap shows up at the worst possible moment

Nobody feels the difference between control and proof on a normal Tuesday. You feel it during the incident, when you have to reconstruct what an autonomous system did across thousands of actions. You feel it during the audit, when a regulator asks for evidence, not assurances. You feel it in the dispute, when a counterparty's agent acted on your behalf and now the two of you disagree about what happened.

In every one of those moments, application logs are worthless as evidence, because you wrote them about yourself. They can be edited, and everyone in the room knows it. Access policies do not help either. They describe what was permitted, not what occurred.

Proof is a different primitive

Accountability is not a better log. It is a cryptographic property. Each action an agent takes is signed at the moment it happens, chained to the one before it, and sealed into a structure where changing any entry breaks the whole thing. The signature verifies without calling home, so a regulator, an auditor, or a counterparty can check it themselves, offline, years later. Nobody has to trust the vendor. The math is the proof.

This is also the piece that survives the boundary of your own company. You can control the agents you own. You cannot control a partner's agent acting on your behalf. But you can both hold the same signed record, and both verify it independently. Access control stops at your perimeter. A signed record does not.

You need both. They are not the same product

None of this is an argument against access control. Control the door and keep the receipt are complementary jobs, and a mature program does both. The mistake is assuming that because you have locked the door, you have the receipt. You do not. Preventing bad access and proving what happened are different mechanisms, and the second one is the one that gets subpoenaed.

MOSS is the receipt. It signs what every agent did, across teams, across vendors, and across the quantum transition, into a record you can defend. Put that next to whatever access control you already run, and you can finally answer both questions instead of one.

See what proof looks like