What M-25-21 asks you to prove about AI agents, and what a record has to look like to prove it

OMB Memorandum M-25-21, issued April 3 2025, replaced the prior AI governance memo and told every agency to name a Chief AI Officer within 60 days, stand up an AI governance board within 90, and publish an inventory of AI use cases at least once a year. For AI it classifies as high impact, where the output is a principal basis for a decision with legal, material, or safety consequences, agencies have to run pre deployment testing, complete impact assessments, keep adequate human oversight with real means of intervention, and stop any system that does not meet those minimums (Hunton Andrews Kurth, 2025).

The memo was written with models in mind. Agents change the question. A model produces an output a person reviews. An agent takes an action: sends the message, files the form, runs the command, moves the money. "Adequate human oversight" of an agent cannot mean reading every output after the fact, because the act has already happened. It has to mean a rule that ran before the act and a record that shows it did.

Three things the inventory owner has to be able to show

First, that a written policy existed at the time of the action and that the action was checked against it. Not a policy document in SharePoint. A machine readable rule set, versioned, with a record of which version was in force when.

Second, that the check was deterministic. If the thing deciding whether an agent may act is itself a model, the oversight is a model watching a model, and no assessor can reproduce the decision. The evaluator has to be ordinary code that gives the same answer on the same inputs every time, with the model attached or not.

Third, that the record cannot have been edited afterward. A log in a vendor dashboard is a claim. A hash chained log, where each line commits to the one before it, is something an assessor can verify with a one file script and no account anywhere.

What that looks like in practice

$ python3 verify_chain.py agency_agent_audit.jsonl
INTACT  14212 events  head 9f3c41ae6b2d…

Each of those 14,212 lines is one agent request: who asked, what action, on what resource, which rule matched, what the answer was, and what obligations attached (log, notify, redact). The policy file that produced them is versioned beside the log. The verifier is Apache licensed and runs on any machine with Python. None of it touches a cloud service, which is the other half of the answer: a control that runs on the endpoint and stores on the endpoint adds nothing to an authorization boundary.

What this does not do

It does not watch what happens inside an agent's reasoning, detect prompt injection, or scan an enterprise tenant for rogue agents. Those are runtime security products and several well funded vendors sell them. This is the owner side record: what the agent was allowed to do, what it asked, and what it was told, provable later. The two are complementary and an agency with both has a stronger compliance plan than one with either.