AI transparency requirements for AI agents

Transparency is a recurring requirement across AI governance frameworks. The EU AI Act, NIST AI RMF, and ISO 42001 all require that AI systems provide visibility into their operation. For AI agents, transparency means three things: explaining what the agent can do, explaining why it made a specific decision, and providing a record of what it actually did.

Three levels of transparency

Capability transparency

Users and operators should know what tools the agent has access to and what boundaries constrain it. This is satisfied by:

• Publishing the agent's tool catalog
• Making the policy file readable (YAML is human-readable by design)
• Documenting the agent's intended use and limitations

Decision transparency

When the agent takes an action (or is blocked from taking one), the reason should be available. This is satisfied by:

• Including a reason field in every policy rule
• Returning the matched rule in the policy decision
• Including content scan results when threats are detected

const decision = guard('email.send', { to: 'user@example.com' });
// decision.reason === "External emails require approval"
// decision.rule === { tool: "email.send", action: "escalate", ... }

Action transparency

A complete record of what the agent did should be available for review. This is satisfied by:

• Hash-chained receipts for every action
• Queryable audit trail through the control plane API
• Session replay capability (trace through all actions in a session)

EU AI Act transparency requirements

Article 13 requires that high-risk AI systems are designed with sufficient transparency to enable users to interpret and use the system's output appropriately.

Article 52 requires that AI systems interacting with humans disclose that they are AI systems (unless obvious from context).

For AI agents, this means:

• Users should know they are interacting with an AI agent
• Users should be able to understand why the agent took or did not take an action
• Operators should have access to the full audit trail

Implementing transparency

The receipt chain is the primary technical mechanism for transparency. Each receipt answers:

• What: Which tool was called with what arguments
• When: Timestamp of the action
• Who: Which user and agent identity
• Decision: Allow, block, or escalate
• Why: Which policy rule triggered the decision
• Integrity: Hash chain proving the record has not been altered

Transparency vs privacy

Transparency and privacy can conflict. Full transparency means recording tool arguments, which may contain personal data. The solution is to provide transparency in layers: operators see full receipts during the investigation window, then arguments are redacted while maintaining the structural transparency of the audit trail.