Meta's Muse Wonder agents raise a question nobody is asking yet

Agents that act for you

Meta has released its Muse Wonder AI agent models, and they are designed to do more than answer questions ^[1]. The models can prepare insurance claims, review lease agreements, develop software and handle other tasks autonomously, without needing a human to approve every step. They process text, images, audio and video, retain context across conversations and work through obstacles toward the goal you set for them.

The announcement outlines safeguards for commercial and research use, including consent mechanisms, privacy controls and limits on which tools an agent can call ^[1]. These are sensible, and they matter. What the announcement does not address is the evidence question: when an agent acts on your behalf and something goes wrong, how do you prove what it actually did?

The safeguards are there

Meta's safeguards cover three areas. First, consent: an agent must be given explicit permission before it can act, and users can revoke that permission. Second, privacy: agents process data according to the user's instructions and the organisation's policies. Third, tool access: the models are built to work within defined limits, so an agent handling a lease review cannot, say, transfer money ^[1].

For commercial deployments, Meta recommends logging, monitoring and human oversight where the stakes are high ^[1]. That is good advice. The question is what happens when the log itself is questioned.

Why the log matters

Think of an agent as your assistant with a to-do list. You tell it to prepare an insurance claim. It gathers documents, fills in forms and submits the claim. Six months later, the insurer disputes what was submitted. You check your log. The insurer has its own record. The two do not match.

Who is right? If the log is kept by the same system that ran the agent, and that system could have edited the log at any point, the log is easy to challenge. It is like keeping a diary you could rewrite whenever you like. It is a record, not evidence.

What the AI Act expects

Under the AI Act, high-risk AI systems must technically allow for the automatic recording of events over their lifetime ^[2]. For systems under Annex III, that applies from 2 December 2027. Article 12 says what to log. It does not say how to protect the log.

An agent preparing insurance claims, reviewing contracts or making decisions about people could well be high-risk, depending on how it is used. If it is, the organisation deploying it will need logs. Whether those logs hold up when questioned is a separate matter, and one worth thinking about now.

The instruction, the action and the result

When an agent acts, three things need to be recorded: the instruction it was given, the tools it called and the result it produced. Say you ask an agent to book a meeting. The agent calls your calendar API, finds a slot and sends an invitation. If the other person later says they never got an invitation, you need to show what the agent did, when it did it and on whose instruction.

That is straightforward when nothing goes wrong. It gets harder when the stakes are higher. Say an agent declines a loan application, approves a refund or changes a customer's order. The person affected has the right to ask what happened. Your log is your answer. If that log could have been edited by anyone with administrator rights, or by the agent itself, the person affected has a fair reason to doubt it.

A digital witness for agent actions

Here, the thing to seal is each instruction, tool call and result, as the agent acts. Sealing takes a fingerprint of the record, not the record itself, so the instruction and the result never leave your systems. The fingerprint is sealed on WitniumChain, where any later change would show, even one made by us. To check, you calculate the fingerprint again and compare it with the sealed one. Change a single character and it will not match.

Anyone you share the record with can check it. That includes the person affected, an auditor, a supervisor or, if it comes to it, a court. The witness shows that the record is exactly what was written at that time. It does not authorise the action or make it correct. It does not prove that the instruction was lawful or that the agent did what you wanted. It shows that the record has not changed since it was sealed.

You seal agent actions through the MCP server. Your system sends a fingerprint of each instruction, tool call and result to WitniumChain and gets a witness ID back. The first 2,000 witnesses a month are free.

How it would work

1. Your agent receives an instruction and prepares to act.
2. Before calling the tool, the agent's framework seals a fingerprint of the instruction.
3. The agent calls the tool and gets a result. That result is sealed.
4. When someone questions what happened, you share the sealed records. They check the fingerprints and see that nothing has changed.

What this means for you

If you are deploying agents that act on behalf of users or customers, ask these questions now:

• What do we log when an agent acts, and where is that log kept?
• Could someone with administrator rights edit the log, and would we notice?
• If a customer or a supervisor questions what our agent did, what evidence do we have that cannot be dismissed as self-serving?
• Are we logging instructions, tool calls and results separately, or just the final outcome?
• When an agent fails or produces an unexpected result, can we show exactly what it was told to do?

The safeguards Meta has outlined are a good start. The evidence question is the next one.

What to watch

The AI Act's high-risk requirements for Annex III systems apply from 2 December 2027 ^[3]. If your agents fall into that category, you will need to show that you have logging in place. Deciding now how to protect those logs gives you time to build it into the system, rather than bolting it on later.

For agents that handle contracts, claims or decisions about people, the stakes are higher. Those are the cases where someone is most likely to ask what the agent did, and where your answer needs to be more than "trust us, this is what the log says".

Agents are arriving fast. The evidence question is worth answering before the first dispute lands on your desk.