EXHIBIT A
Unsafe trace chronology
payment.transfer occurs before policy.audit.
second_signature.run → agent.request → payment.transfer, policy.audit
SECOND SIGNATURE
AI AGENT BOUNDARY RECONSTRUCTION
VERIFIED RECORDED TELEMETRY
Financial incident reconstruction
THE PAYMENT SUCCEEDED.
THE GOVERNANCE FAILED.
Execution rail
TRANSFER INTENT → PAYMENT EXECUTED → POLICY AUDIT
TRANSFER INTENT
POLICY BOUNDARY
APPROVAL
PAYMENT EXECUTION
CRITICAL INCIDENT
FIRING
UNSAFE AUTONOMOUS FINANCIAL ACTION DETECTED
STATUS FIRING
SEVERITY CRITICAL
service.name = "second-signature"
name = "policy.audit"
governance.outcome = "unsafe_success"
count() > 0
Execution rail
TRANSFER INTENT → POLICY EVALUATE → APPROVAL REQUEST → REJECTED → PAYMENT BLOCKED
TRANSFER INTENT
POLICY BOUNDARY
APPROVAL
PAYMENT EXECUTION
Execution rail
TRANSFER INTENT → POLICY EVALUATE → APPROVAL REQUEST → FINANCE_LEAD → PAYMENT EXECUTED
TRANSFER INTENT
POLICY BOUNDARY
APPROVAL
PAYMENT EXECUTION
SigNoz evidence exhibits
Verified recorded telemetryEXHIBIT B
Guarded rejection
approval.request rejected; payment.blocked.
second_signature.run → agent.intent.transfer → policy.evaluate → approval.request → payment.blocked
EXHIBIT C
Approved execution
approval.granted by FINANCE_LEAD precedes payment.transfer.
second_signature.run → agent.intent.transfer → policy.evaluate → approval.request → approval.granted → payment.transfer
EXHIBIT D
Invariant query — no results
No traces where approval was rejected and payment still executed.
governance.outcome = "rejected" AND payment.executed = true → 0 results
EXHIBIT E
Critical alert — FIRING
Trace-based condition matches unsafe_success span.
service.name = "second-signature" AND name = "policy.audit" AND governance.outcome = "unsafe_success" AND count() > 0
Trace register
Copied identifiersOUTCOMETRACE RECEIPT
UNSAFE SUCCESSc85c14d06fd1a1ede6ec428263f5d9d5
SAFE STOP97611ea6d140d4994ea5fe110c935326
SAFE SUCCESS3b91c821d591b076559bcf777b8459f7