An agent you cannot report against is an agent you cannot govern. For a static model, a disclosure surface can be added at the edge — a form, an inbox, a triage queue. For an agent that plans, calls tools, and acts over time, the surface reaches inside: it depends on what the system retained while it was running.
If the agent did not record why it did what it did, no reporting channel bolted on afterward can reconstruct it. For agentic systems, the disclosure surface is not a channel you attach — it is runtime retention, the pipeline that captures and normalizes it, safe harbor, and coordination, designed into the architecture or forfeited.
Agents fail differently
The forensic requirement is specific and it has been mapped. Incident analysis for AI agents identifies causal factors across three layers — system, contextual, and cognitive — and, critically, specifies what an agent’s records must retain to make analysis possible at all: activity logs, chain-of-thought or reasoning traces, and a record of tool access [1]. That list is an architecture specification. Each item has to be captured at runtime, in the moment, or it is gone. You cannot recover a reasoning trace after the fact from an agent that did not emit one, and you cannot audit a tool call that left no record.
This is the hinge that separates agent disclosure from model disclosure. The model’s flaw is in its outputs; the agent’s flaw is in its trajectory — the sequence of decisions and actions that produced an outcome. Reporting against a trajectory requires the trajectory to exist as data, which means retention is a precondition for the disclosure surface to function, not a feature of it.
The missing layer: from runtime to record
Naming what must be retained [1] is not the same as building what carries it there. Between the agent acting and a report existing sits a layer the disclosure conversation routinely skips: the pipeline that turns raw runtime activity into a durable, schema-conformant record. Call it an event pipeline, an observability layer, a decision log, a trace store — the terminology varies; the function does not. It captures activity logs, reasoning traces, and tool calls as they happen, normalizes them to the canonical schema, and links each record to the incident it belongs to.
This is the bridge that makes the surface cohere. Part 2 established that the schema is what turns individual reports into evidence; Part 1 named trace linkage as one of the six components of a disclosure surface. The pipeline is where those meet — the transport-and-normalization layer between an agent’s runtime and the evidence store. Without it, the architecture jumps straight from the agent did something to someone filed a report, with nothing in between — and that jump is exactly where trajectories go missing. Retention is the storage; the pipeline is what fills it, in the right shape, while the shape is still recoverable. Design the two as one: a trace store with no pipeline feeding it is as empty as a disclosure channel with no safe harbor protecting it.
Safe harbor is architecture, not legalese
A channel no one is protected to use is not a surface — it is a liability trap. The third-party disclosure argument for general-purpose AI prescribes legal safe harbors alongside broadly scoped disclosure programs and coordination infrastructure, so that good-faith finders can report without fear of retaliation or strict-liability exposure [2]. The software field learned this in practice: HackerOne’s Gold Standard Safe Harbor exists because researchers will not probe systems they can be sued for probing. Safe harbor reads like a legal artifact, but its effect is architectural — it determines whether the surface receives reports or sits empty. Design the program scope and the protection together, or the channel is decorative.
The interoperable instrument
The instrument that ties retention, scope, and coordination together is now built. FLARE-AI operationalizes flaw reporting as open-source, interoperable infrastructure: conditional logic that adapts the report to the flaw, and machine-readable dissemination that routes a single submission to multiple recipients at once [3]. That last property is what makes coordination tractable at ecosystem scale — a finder files once, and the report reaches the developer, the deployer, and any relevant coordinating body without re-entry or manual fan-out. For an agent operator, this is the difference between a disclosure surface that scales and one that collapses under the coordination overhead Part 1 identified as a core failure mode.
Bounties price the surface
A surface that exists but is not worth using still fails. The economics are studied: an empirical analysis of Google’s Vulnerability Reward Program shows how the supply of high-value reports responds to reward structure — reward elasticity that any bounty or disclosure incentive has to reckon with [4]. The lesson for agentic AI is that incentive design is part of the architecture of the surface, not a marketing add-on. If reporting a serious agent flaw earns nothing and costs the finder time and legal risk, the surface receives the flaws no one values and misses the ones that matter. Price the surface deliberately, informed by what the software-security field already knows about elasticity.
Coordination as ecosystem infrastructure
No single operator’s surface is sufficient, because agent harms cross organizational boundaries the way agent actions do. The Columbia Convening on openness and AI safety framed safety as ecosystem-wide infrastructure — shared harm taxonomies and coordination mechanisms that no one vendor owns [5]. This reframes the disclosure surface as a shared substrate: the interoperable instrument [3] is the tooling, and the ecosystem coordination is the institution it plugs into. An enterprise building an agent participates in this infrastructure rather than reinventing it, which is both cheaper and more defensible to an auditor asking how flaws leave the building.
The regulatory route
Voluntary surfaces have a ceiling, and sectoral regulation is one way through it. An analysis of incorporating AI incident reporting into telecommunications law and policy, drawing on India’s regime, shows how sector regulators can convert voluntary reporting into mandatory obligation and surfaces the disclosure barriers that persist even then [6]. For regulated enterprises — financial services, healthcare, telecom — this is the near-term reality: the disclosure surface will be specified by a regulator whether or not the architecture anticipated it. Building it in early is cheaper than retrofitting to a mandate, and it puts the enterprise ahead of the obligation rather than behind it.
Transparency is the substrate
Underneath all of it sits the question of whether developers disclose enough for any surface to matter. The Foundation Model Transparency Index measured leading developers and documented sustained, systemic opacity across the dimensions that disclosure depends on [7]. This is the environmental condition the whole series operates in: a disclosure surface assumes a baseline of transparency about what the system is and does, and that baseline is not yet reliably present. For the architect, the implication is to treat transparency as something the system must produce, not something the ecosystem will supply — instrument the agent to disclose, because the field default is not to.
An agent that cannot be reported against is an agent that cannot be governed. Retention of activity logs, reasoning traces, and tool-access records is not a forensics nicety — it is the precondition for the disclosure surface to function at all, and it can only be captured at runtime, by a pipeline built to capture it.
Safe harbor, incentive design, interoperable routing, and ecosystem coordination decide whether the surface fills; the runtime pipeline and its trace store decide whether it can exist. Build the disclosure surface into the agent’s architecture, or forfeit the ability to govern the agent permanently — because the trajectory you did not record is not recoverable, at any price, after the fact.
That is the series’ throughline in one line: flaw disclosure is not a policy the enterprise adopts. It is a surface the architecture either has or does not — first to the customers the system serves, then to the board, auditors, and risk committee accountable for that trust.
