Investigate one consequential agent action
Connect business intent, approval, action version and provider evidence without mistaking a trace for proof of an external effect.
An incident question usually starts with a business event: who authorized this refund, which file changed, or why did this customer receive an email? A model conversation alone cannot answer it. Follow the identifiers from business intent through execution to provider evidence.
Anlyon invocation records identify the executed action and result. Governed effects add outcome and verification information. These are database records with provider evidence, not cryptographically immutable attestations.
Assemble the chain
| Layer | Evidence to retain |
|---|---|
| Business task | Order, ticket or change identifier and intended operation |
| Request | Input, environment, requesting identity and operation key |
| Review | Preview, expiry and decision identity |
| Execution | Invocation, effect and action version |
| Provider | Operation identifier and relevant read-back evidence |
| Resolution | Outcome, grade and whether evidence was provider or manual |
Retain the connection between layers. A provider receipt without a business operation reference can be difficult to attribute; an approval without the request it covered does not explain what was authorized.
Ask precise questions
First establish whether the call was routed through Anlyon. Direct provider access is outside its execution records. Then distinguish admission refusal, approval denial, dispatch failure, unknown outcome and confirmed result. The same application error banner can hide all of these.
For a changed file, inspect the reviewed version and provider commit evidence. For a refund, compare payment, amount and currency. For email, distinguish provider acceptance from inbox delivery. Avoid broad conclusions from one status field.
Preserve useful evidence without excess data
Store stable identifiers and decision-relevant fields. Keep provider credentials out of logs. Apply your retention and access policy to customer content and evidence exports. A screenshot can help an operator, but it should not replace machine-readable identifiers when those exist.
If the evidence cannot establish the outcome, leave that uncertainty explicit and assign a reconciliation owner. Do not let the pressure to close an incident turn unknown into failed.
Read outcomes and invocation records, the unknown-action runbook and manual resolution.