An approval event is not the result
A trace can show that an agent asked for approval without proving that the tool waited. It can also show an approved call without proving that the executed arguments were the ones a person reviewed. Those are ordering and identity questions, so they need an event record designed to answer them.
The useful unit is one tool call with a stable correlation identifier. Around that call, the record needs enough information to reconstruct the approval decision, execution boundary, and result—without relying on a screenshot or a model's narrative of what happened.
A minimal evidence contract
For an approval-gated call, a checker should be able to establish:
- A rejected call did not produce an execution event.
- An approved call did not begin execution before approval.
- The approved and executed argument bytes were identical.
- The call executed no more than once and completed no more than once.
- The observed result correlates to that exact call.
- A tool declared read-only was not unnecessarily approval-gated.
These checks are deliberately narrower than “the agent was safe.” A passing record says that the required evidence for these properties was observed. It does not certify the tool implementation, the model, the surrounding application, or the human decision.
Fingerprint exact bytes, not parsed intent
Parsing arguments and serializing them again can erase meaningful differences. Key order, whitespace, escaping, duplicate keys, and number formatting may change while the parsed object appears similar. If approval applied to a particular raw argument string, the evidence should fingerprint those exact UTF-8 bytes and compare that digest at execution time.
A digest also lets the default record avoid storing prompts or raw tool arguments. That reduces accidental data collection, but it is not encryption and does not prove the underlying arguments were benign.
Missing evidence must stay missing
Instrumentation has blind spots. A checker that cannot observe the approval decision or execution boundary should return a distinct “not observable” outcome. Treating absence as a pass makes the report reassuring precisely when it knows the least.
This is why the evidence contract matters as much as the individual assertions: it defines which events must exist, how calls correlate, and when the checker must refuse to conclude.
The current measured boundary
YY's reference implementation targets OpenAI Agents SDK 0.19.x FunctionTool workflows with static approval configuration. Dynamic approval callbacks, hosted tools, computer and shell tools, MCP tools, and custom tool implementations are outside the founding release's measured scope.
The public reference fixture reports 6 PASS, 0 FAIL, and a passing gate. Its JSON output is available to inspect without buying the checker.