The audit trail already crosses firm boundaries. Its linkage key names the account, not the agent.

On 13 August, Aashis Luitel named the failure in delegated agent action with unusual precision. When an agent transacts across several companies' systems, every participant holds one slice and nobody holds the join. The model provider sees the instruction. The venue sees the order. The processor sees the money. Each can show that something happened. None can show that the user authorized that action inside that task.

He proposes five remedies. Four are policy. The third is infrastructure, and it is the one worth pulling out: a task reference identifier, which he compares to a distributed-tracing id — a token that stitches scattered records across parties without exposing what is inside them.

That is not a metaphor reaching for something. It is a specification, and it already exists twice over. Once as a web standard. Once, at national scale, inside US equities. Neither one currently carries what you need, and the more useful of the two is being made smaller this year.

The primitive has a spec, and its virtue is that it says nothing

The W3C's Trace Context recommendation defines a traceparent header in four fields: version, trace-id, parent span-id, flags. The trace-id is sixteen bytes, rendered as thirty-two lowercase hex characters, and it must stay constant across the entire trace no matter how many services the work passes through.

Look at what that object is, and more importantly at what it is not. It is not a credential. It is not a claim. It carries no payload, asserts no fact, and grants no permission. Handing it to a counterparty tells them nothing about your customer, your position, or your intent.

That emptiness is the whole design. Trace context propagates across organizational boundaries between firms that share no identity system, no directory, and no reason to trust each other, precisely because passing it along costs nothing and reveals nothing. It is a spore, not a dossier. The receiving system does not need to understand your business to keep the token alive; it only needs to not drop it.

This is the shape of coordination that actually spreads. Not a registry someone has to run. A convention cheap enough that defecting from it is more work than complying.

Finance already runs the largest one of these in existence

Here is the part the agentic-delegation conversation keeps missing.

Cross-organizational event correlation among competing firms is routinely described as the hard, unsolved problem. US securities markets solved it a decade ago and have been operating the result ever since. Under Rule 613, the Consolidated Audit Trail ingests order lifecycle events from roughly 1,800 broker-dealers, exchanges and self-regulatory organizations. A Firm Designated ID links an order to its originator. Interfirm linkages stitch an order routed from one broker to another into a single reconstructable chain, and when a reference tag gets dropped at a system boundary the downstream event fails to link — a documented, monitored failure mode with error reports attached to it.

So the primitive is not hypothetical here, and neither is the discipline of propagating it. Your industry already knows how to make an identifier survive a handoff between parties who compete with each other. That is the expensive part, and it is done.

It correlates the wrong noun

CAT links an order to an account. The Firm Designated ID names where the order came from in the sense of which book it belongs to. The lifecycle links order events to order events.

Nothing in that chain records that a third-party agent formed the intent, under what mandate, with what limits, or whether that grant was still live at the moment of submission. Reconstruct a CAT lifecycle perfectly and you have proved that an order originated from an account and was routed and filled. You have not touched Luitel's question. His gap passes straight through the most complete audit trail in finance without being narrowed at all.

FINRA's 2026 oversight report flags autonomous agents as an emerging concern that may require novel oversight, including tracking actions and restricting system access. A different section of the same report finds CAT reporting still incomplete, inaccurate and untimely, with weak error correction and insufficient oversight of third-party reporting agents. One report, two chapters, no line drawn between the tracking problem and the tracking system.

And the trail is being made shorter, not wider

On 27 March 2026 the SEC approved an NMS plan amendment that lets CAT delete data older than three years, stops creating interim lifecycle linkages unless a regulatory user asks, drops reporting of rejected messages, discontinues parts of the targeted query tool, and revises how anonymized customer identifiers are generated. Estimated savings: $50m to $70m a year against an operating budget of roughly $188m. Chairman Atkins framed it as building "towards a more efficient and cost-effective CAT," and noted the Commission has cut projected annual operating costs by over $100m and permanently eliminated reporting of personally identifiable information.

Three weeks later, on 16 April, the Commission issued a concept release — file S7-2026-12 — asking whether the audit trail should exist in this form at all. Its enumerated topics for comment: funding and cost management, the regulatory purpose of the CAT, its structure and governance, its design and scope, and cybersecurity and data privacy. Comments closed on 22 June. The plan operator filed its own letter that day.

Read that list of topics again. Who or what originated an order is not on it.

Meanwhile the population that needs the answer keeps growing. Robinhood's agentic beta has passed 70,000 accounts across equities and options, with third-party agents from Anthropic, OpenAI and Grok reaching dedicated sub-accounts over an MCP server and submitting orders without per-trade approval.

Now read the whole thing as a price. A budget of $188m, cut by a third, retention capped at three years, and an open question about the entire design. That is the commons telling you, in the only language it has, exactly how much it intends to pay to remember things. It is a revealed preference and it points one direction. Do not build a plan that depends on the central repository growing a field for your mandate. It is shedding fields.

The other half shipped — in the wrong industry

The consent artifact CAT lacks is not missing from the world. It is filed under commerce.

Google's Agent Payments Protocol captures a user's request as a signed Intent Mandate, then locks the specifics into a Cart Mandate at approval, both as cryptographically signed verifiable credentials. Chained intent to cart to payment, they are built to be non-repudiable evidence of what the user actually instructed. For the delegated case — buy the tickets the moment they go on sale, human not present — the detailed Intent Mandate is signed up front, which is precisely the standing-authority structure a rebalancing agent operates under.

So both halves of Luitel's evidence chain are running in production today. The correlation half lives in securities regulation. The consent half lives in retail checkout. They do not touch, they were never designed to, and nobody owns the seam between them.

Do not confuse the two halves

This is the part to nail down before writing any code.

A trace id proves that a set of records belong to one task. It proves nothing whatsoever about consent. If you mint one, propagate it diligently, and call the result an audit trail, what you have built is a very tidy way to reconstruct an unauthorized trade. Correlation without a signed mandate is legibility, not authorization — and legibility that looks like compliance is worse than no record at all, because it will be produced against you with the gaps already indexed.

The second failure is quieter. An identifier you mint that nobody downstream propagates is a local log with extra ceremony. All the value is in the hop. Which makes this a coordination problem, and coordination problems get settled by whoever moves first at a low enough cost that copying beats negotiating.

What to carry

Mint the id at intent, not at execution. The span that matters opens when the principal says the thing, not when the order hits the wire. If your identifier is born at submission you have already lost the segment that contains the authorization.

Bind it to something signed. The id stitches; a mandate proves. AP2's two-stage structure — a signed grant of scope up front, a signed confirmation of specifics at the point of action — is public and copyable. Nobody's permission is required to adopt the shape.

Propagate it into every field you control that survives the boundary. Client order identifiers, reference and memo fields, tool-call metadata on the MCP side, your own logs at every hop. Some counterparties will drop it because they do not know what it is. Send it anyway. A passenger field costs close to nothing and a missing segment costs a deposition.

Keep your own copy past three years. This changed in March. The central repository has been instructed to forget, and the disputes that turn on whether a human authorized a specific delegated action will not respect that horizon. Long memory is now local knowledge, which is to say it is your job.

Publish your format. A trace id only you can interpret is not a trace, it is a serial number. The convention becomes valuable the moment a second party can read it without asking you.

No one is going to plan this field into existence. The window where a central planner might have added it closed in June, framed around what to subtract. What emerges instead will be the order that always emerges when a token is cheap to carry and expensive to lack: enough agents independently decide that passing it along beats arguing about a trade afterward, and one day the header is simply there, in everything, with no mandate behind it.

That is how trace context happened the first time. Nobody required it. It just became more work to drop.