I spend most of my time building evidence layers for AI agents. The reflex in that work is to reach for a signature. Something happened, sign the record, hand it to the auditor, done.
Three things from the last five months say that reflex is wrong, or at least badly incomplete. One is a governance draft that never asks for a signature at all. One is a CVE where the signature verified correctly and the client still ended up talking to an attacker. One is a limit in a spec I wrote myself.
Read together they point at the same thing. A signature is a statement about an object. Almost every security question you actually care about is a statement about a relationship.
Case one: the requirement that is not there
The Open Secure AI Alliance published its Shared AI Findings Exchange draft on GitHub on August 3. It is an incident-reporting compact for AI agents. Members agree to report when an agent they operate accesses or disrupts a third-party system without authorization, and to do it on a clock: notify the affected organisation as soon as possible, notify customers with credible exposure within 72 hours, file a confidential report within four business days.
