The part I would like to understand better is what happens when one task spans several systems.

A simple example. An agent is asked to reconcile an invoice. It reads the invoice record, it calls a payments API to check status, and it writes a settlement note. Three steps, three systems, all within the agent's role. Now suppose the amount it settles differs from the amount it read, or the settlement goes to a different counterparty. Every individual entry is valid: the identity is correct, the permission was granted, the API call succeeded. The run as a whole is outside what the agent was asked to do.

Prevention, detection and containment all depend on recognising the event. Here nothing is exploited and no signature matches, so there is nothing to recognise until a human notices the money is wrong.

So my question is this. What is the recommended way to hold the authority for a run, meaning what the agent was asked and permitted to do across the whole task, alongside the observed actions, so the two can be compared afterwards? And is that record produced independently of the components under investigation, or does it rely on the same telemetry that would itself be in question?