Could You Reconstruct Your Agent’s Last Action?
A useful test for any AI agent is simple: can the organisation reconstruct its permissions, actions and personal-data decisions?
On 8 October 2026, the UK data protection regulator reported that ten major foundation-model developers had made, or committed to make, changes after supervision. It also opened an agentic AI evidence call that runs until the end of 20 November 2026.
This is a supervision outcome and an open consultation, not new law or final guidance. Developer commitments are not certification. Separate enquiries into reported agent testing and deployment are ongoing; they are not findings of non-compliance.
Three regulatory signals need different responses
| Signal | Current status | What an organisation can do now |
|---|---|---|
| Foundation-model supervision | Ten developers made or committed to changes covering clearer information, rights mechanisms and safeguard assessments. The ICO is monitoring progress. | Check whether supplier claims are supported by contractual commitments and evidence that applies to the service you use. |
| Open evidence call | The open consultation covers security, transparency, accountability, automated decision-making, fairness and lawful processing, with purpose limitation also included. | Use one real workflow to find where evidence is strong, missing or split between teams and suppliers. |
| Agent testing enquiries | The regulator’s enquiries are ongoing. They are not published breach findings. | Review comparable testing and deployment controls without attributing a legal conclusion to the organisations contacted. |
Agents can use tools, visit websites and reach external services. Governance therefore needs an execution trail showing permitted actions, supporting data and the person who can stop or reverse a result.
Build an evidence trail around one real task
BlackTree assessment: start with a single end-to-end agent workflow rather than a generic AI policy. Choose a task that touches personal data or can trigger an external action, then preserve evidence at each decision point.
- Define the purpose and data boundary. Record the business purpose, personal-data categories, lawful basis, retention rule and prohibited uses. Include data the agent can infer or retrieve through a tool.
- Map permissions. List the identities, tokens, applications, websites, repositories and communication channels available to the agent. Show the difference between read, write, approve and administer access.
- Place human decisions deliberately. Identify actions that need approval before execution, the information shown to the reviewer and the route for refusing or reversing an action.
- Keep a usable execution record. Capture the agent version, instructions, tool calls, material inputs, outputs, policy decisions, approvals, errors and resulting changes. Protect the log itself and set a justified retention period.
- Test misuse and failure. Exercise excessive permissions, manipulated content, data sent to an unapproved destination, repeated actions and attempts to bypass a control. Record the expected block, the observed result and the accountable owner.
- Connect rights and incidents. Make it possible to locate relevant records, correct or delete data where required, contain an agent and explain a consequential decision to the affected person.
Use the consultation without exposing sensitive details
Organisational responses may be published in full or summarised and considered under freedom of information law. Do not place secrets, personal data or unnecessary incident detail in a submission.
A useful response can describe the control pattern, the evidence it produces and where the law or guidance remains unclear. Keep the underlying sensitive records in the organisation’s controlled evidence store. The immediate benefit is a reviewable agent workflow, whatever follows after the consultation.
Sources
- ICO supervision and agentic AI announcement, published 8 October 2026.
- ICO agentic AI call for evidence, opened 8 October and closing 20 November 2026.
Related: AI Agents Need Better Boundaries.
