Evidence before inference: a trust model for AI agent security
Why AI agent security should treat agent transcripts as claims and infrastructure activity as evidence — and the five rules Inwom uses to keep inference honest.
Evidence before inference is a trust model for AI agent security: agent transcripts are claims, trusted runtime activity is evidence, inferred relationships remain inferred, communication is not authorization, and AI reasoning never becomes authority. It prevents an agent — or an AI-powered detector — from talking its way into a conclusion the evidence does not support.
The five rules
Inwom applies five rules to every conclusion it produces:
- Agent transcripts are claims. What an agent says it did is not proof.
- Trusted runtime activity is evidence. Identity, tool, resource, and policy events establish what happened.
- Inferred relationships remain inferred. Communication or coordination derived from patterns is labelled as such.
- Communication is not authorization. One agent telling another to act grants no permission.
- AI reasoning never becomes authority. Model output can prioritise work, but cannot by itself establish facts or grant access.
Why this matters for agents
Agents produce fluent, confident explanations. A compromised or drifting agent can describe benign intent while acting otherwise, and agents can relay each other's claims until they look like consensus. Grounding analysis in infrastructure evidence breaks that loop.
The same discipline applies to the detector. If an AI system labels agents as coordinated, analysts need to see the observed events behind the label and the confidence of each inferred step.
Applying the model
Practically, this means preserving provenance for every event, recording which conclusions are observed versus inferred, modelling legitimate automation as an explicit alternative explanation, and never letting an agent's self-report override a contradicting infrastructure record.
Questions people ask
Why not use agent logs as the source of truth?
Agent logs and transcripts are produced by the system being monitored. They are useful context but can be incomplete, mistaken, or manipulated. Trusted infrastructure telemetry is independent of the agent's own reasoning.
Does this model reject AI-based detection?
No. AI can help find patterns and prioritise investigations. The model only requires that AI output is treated as inference supported by evidence, never as authority on its own.
Primary references
These sources define the broader agentic-AI security landscape. Inwom’s population-level detection model is its own product and research direction; these organizations do not endorse Inwom.
- NIST — Agentic AIResearch, standards, evaluation, interoperability, and risk management for agentic AI.
- MITRE ATLAS — Threat Matrix for AI SystemsA living knowledge base of adversary tactics and techniques involving AI systems.
- OWASP — Top 10 for Agentic Applications 2026A threat-focused framework for autonomous and agentic applications.