How do I prove an AI agent did NOT do a step it was supposed to skip?
You bound it instead of proving it absolutely: run the job recorded, with the prohibition saved in the instruction step, then show the complete step trail with the forbidden action absent from it and no unrecorded channel the agent could have used. Review the receipt and actual deliverable before accepting a handover.
Scope: no system can prove a universal negative about the whole world. This page's method proves the bounded claim: within this job's complete record, across the channels the record governs, the step does not appear.
Forbidden steps are where compliance gets real: do not contact the client directly, do not change prices, do not read the payroll folder, do not skip the approval. Afterwards someone asks the hardest question in verification, not "show me what happened" but "show me what did not."
The bounded method has three parts. First, the prohibition is explicit and saved: the instruction step names the forbidden action, so "skipped" is measured against a written rule, not a memory of one. Second, the job's record is complete for the job: every step the agent ran is in the trail, so the trail's silence about the forbidden action means the action is absent from the governed work, which is a checkable property of a finite set. Third, the side channels are closed by configuration, not by hope: the agent's access for this job did not include an unrecorded path to the forbidden action, and the access inventory shows it.
Presented that way, the answer satisfies the audiences who actually ask: clients, auditors, and your own incident reviews. Presented as an absolute ("we guarantee it never happened anywhere"), it satisfies no one careful, and this page's scope line exists so that nobody using this file ever presents it that way.
Checklist: proving the bounded negative
1. Prohibition saved: the forbidden action named in the job's instruction step. 2. Complete trail: the job's steps, all of them, with the forbidden action absent; the trail's own receipts recompute, so its completeness for the job is checkable. 3. Channels closed: the access inventory for the job shows no unrecorded route to the forbidden action. 4. Statement form: "Within this job's record, across its governed channels, the step does not appear," never an unbounded guarantee. 5. Review: a second person re-reads the trail against the prohibition before the statement is sent.
Worked example
The structure the checker reads is an ordinary job record, for example https://zambo.dev/handover/bd7e5325-33fd-4c5e-b029-76b781fa2f51 : five steps, the complete trail for that job, each step openable. A prohibition check against such a record is a reading task with a definite end, which is what makes the bounded negative presentable at all.
Frequently asked questions
What if the agent had access to the forbidden system for other steps?
Then the bounded claim narrows honestly: the trail shows the accesses that occurred as steps, and the forbidden action is absent from them. Access alone is not the action; the record distinguishes the two, which is precisely why steps, not permissions, carry the proof.
Can the agent hide a step from the record?
Within the governed connection, steps are saved as they run; an action taken outside the connection is outside this job's record, which is why part 3 of the checklist, closing side channels by configuration, is not optional garnish but half the proof.
How do I phrase this to a client without sounding evasive?
Use the statement form in the checklist, and show the trail. Careful clients prefer a bounded claim with a checkable trail to an absolute claim with none; the bounded form is what confidence actually sounds like.
By Brennan Zambo, founder of Zambo.
Last verified: 2026-10-17.
Try a handover
A handover gives your client one proof link with verifiable receipts to review, then Accept or Flag.
try it: say 'use zambo to hand this over to <client>' in your ai