LLMエージェントの「できました」を検証する(2)— AIが記録を改竄できない構造を、OpenTelemetry Collectorで作るThe author closes two prior demo weaknesses by using OpenTelemetry Collector…

As large language model agents move beyond chat and begin to take real actions, a stubborn question shadows every report of success: how do you know an agent actually did what it claims it did? A follow-up post published on Zenn tackles this directly, arguing that the trustworthiness of an agent's own records is a blind spot in current discussions of AI observability, and that closing it does not require any new tooling.

The author begins with two confessions about an earlier demonstration. In that demo, the party declaring success was also the party emitting the trace, meaning that, in principle, the trace could be falsified together with the claim it was supposed to substantiate. Separately, the moment the author most wanted to showcase, a false completion being rejected at a gate, never actually surfaced during the demonstration. The new article is framed as an effort to close both weaknesses.

What stands out is the economy of the approach. According to the post, the fix relies on only three ingredients: the OpenTelemetry Collector, Unix permissions, and about 30 lines of configuration. No new software is introduced. The author is also careful about naming the result, insisting that what was built is not "a slightly safer demo" but rather a structure in which an AI cannot tamper with its own execution records.

Understanding why that distinction matters requires a little background. OpenTelemetry is a widely adopted open standard, hosted under the Cloud Native Computing Foundation, for generating and collecting telemetry, meaning traces, metrics, and logs, from software systems. Its Collector is a standalone process that receives this data, optionally processes it, and exports it to a backend. In conventional use, the Collector is prized for being vendor-neutral and for decoupling instrumentation from storage. Here, that same decoupling is repurposed as a trust boundary.

The core idea appears to be separation of roles. When an agent both performs work and writes the authoritative record of that work, the record inherits the agent's incentives and capabilities; a system that can claim completion can also, in principle, manufacture the evidence for it. By routing telemetry through a separate Collector process and using Unix file ownership and permission bits to deny the agent write access to the stored records, the design makes the agent a sender of data rather than a custodian of it. The agent can emit signals, but it is likely unable to alter what has already been captured, because the operating system enforces who may write where.

This aligns with long-standing security principles that predate the current AI wave, including separation of privilege, the notion of a trusted computing base, and append-only or write-once logging. The novelty is less in the individual components than in applying them