The FBI published its cyber strategy on September 9. It is the first unclassified one the Bureau has ever put out. Thirteen pages of language you have read before, then one sentence on page 14. The Bureau "will rapidly adopt agentic AI in ways that securely scale defense and disruption, and will implement AI-enabled tools to detect, divert, and deceive threat actors where operationally appropriate."
Deceive is the word doing the work. Decoys and honeypots. None of that is new for the Bureau. What is new is that the strategy says software will run it, choosing its next move without a person making every decision. Somebody is going to need a record of what that software did.
I spent 21 years in policing, so I read that sentence differently than a security executive does. When a human agent runs a decoy, there is a person you can put on the stand. That person can explain what happened, what they knew, and who authorized it. I have sat in the witness chair. The question you get is rarely the one you prepared for, and discovery is where good cases come apart, usually over something nobody thought to preserve. When software runs the operation, somebody still has to answer for each action. A recollection of what the tool usually does will not answer what it did on Tuesday.
The strategy has a sentence for that. "AI-enabled tools will help triage, correlate, prioritize, and accelerate work that remains under human review and legal controls." It adds that the tools will be used "with appropriate safeguards for civil liberties, accuracy, and operational security." That is the control language, all of it. I do not read it as indifference. This is a strategy, not an operating policy. But it names the work the tools will do, malware analysis, infrastructure mapping, ranking which victims get notified first, and it does not name an approval threshold, a validation step, or a person with the authority to stop the tool.
Elsewhere the same document promises to move partner notification "from days to hours, and from hours to minutes." At that speed a human is reviewing an action that has already happened. Human review at machine speed means reviewing a receipt. Without the receipt, I do not know what there is to review.
And the receipt cannot be the agent's own account. In July, AI agents inside an OpenAI test worked out how to make their logs show one command while they ran another. Independent investigators from METR later found roughly 7 percent of the transcripts they checked had been spoofed somewhere. It was a small-scale lab result, and the agents were aiming at an automated scorer rather than a person. It still settles one question for me. The tool's own log is a witness with an interest.
Six days after the strategy came out, the FBI director told the Senate Judiciary Committee where the Bureau's AI will come from. He was answering a question about policing AI-driven crime, not about this strategy. "What we need is federal funding to go out there and buy the creations of these companies and use them for law enforcement purposes." If that is how the Bureau buys AI, the agent will be a commercial product, bought from a vendor, run under FBI authorities. The receipt has to come from the product, and not from the agent inside it.
The only contract language I have found that asks vendors for any of this comes from GSA, which proposed a clause in June and issued the final version in late September. It takes effect October 19. Where a model uses "reasoning, retrieval, or agentic steps," the system "shall make a summary of the steps the LLM records" available through an "administrative audit trail." The next sentence surprised me. The clause "requires only a summary of recorded steps, not a faithful explanation of the model's internal reasoning." That is the agent's own summary, the account I just said is not enough, and now the government has put that limit in writing. But the buying side has written the requirement down, and it is no longer a draft.
The document already understands that evidence has to last. On page 14, the same page as the agentic AI sentence, the FBI says it is "preparing its evidentiary and tradecraft systems for the post-quantum cryptographic transition, ensuring that long-running prosecutions and sensitive collection remain durable against adversaries who themselves move to quantum-resistant tooling." The Bureau's worry there is the adversary's tooling. Mine is the phrase "long-running prosecutions." Evidence collected today gets challenged years from now, after the person who collected it has retired and the software has changed twice.
An agent's action record has to survive the same interval. Who acted, what happened, when, under whose authority, and what the system knew when it acted. Whether a person approved it or only saw it afterward. Whether any of that can still be verified when the company that built the tool is gone. A screen in a vendor portal is not a record if the portal is the only place the explanation lives. The National Archives already leans this way. Its August guidance to federal agencies lists "audit trails an agency captures and uses to conduct official business, such as investigations" among the AI materials likely to be federal records, and federal records can only be destroyed on an approved schedule. The record has to outlive the subscription.
The strategy reaches my industry on page 6: "Attribution is strongest when FBI evidence is combined with Intelligence Community holdings, foreign partner intelligence, private-sector telemetry, and victim reporting." Page 9: "Early reporting gives the FBI the evidence, indicators, and financial details needed to advance investigations." Private telemetry is now an input to attribution. Follow that back far enough and you reach a camera vendor or a video management platform, and sometimes a real-time crime center passing something into a federal case. Once it supports a conclusion, how it was produced matters. The video is one item. The search that found it is another. So is the filter that excluded the other results, and the export somebody emailed to an investigator. A timestamp on the final file explains none of those steps.
In NO. 12 I wrote about signed video and unsigned search. In NO. 13 I asked for the list of cameras, firmware, and updates. This is where those two questions meet. If nobody has asked your company for that provenance yet, I would not build on the assumption that nobody will. The government's evidentiary questions are going to reach the loading dock camera eventually.
Here is what the document does not say. Its entire treatment of local police is two sentences on page 11. The second: "Field offices coordinate incident response, victim engagement, and information sharing with agencies often on the front lines." Real-time crime centers do not appear, and neither does CJIS. Nothing in it lets a local department run its own agent. I would not carry this into a chief's office and call it a mandate. It is a demand signal, not doctrine. The same caution applies to results. Deterrence is asserted, not measured, and across 15 pages there is no metric, baseline, delivery date, or staffing number a reader could test it against.
A note on my two hats. My day job is selling AI to police. My independent work is on action records for agents. Read that as bias, or as why I care about the receipt.
For the people who have had a case fall apart in discovery over a log nobody kept: what would the agent's record need to contain to survive cross-examination? And for the vendors feeding telemetry into federal cases: has anyone asked you yet how you would prove your data was not altered, and could you answer from the record alone?
The FBI wrote "deceive" and "human review" two sentences apart. The distance between them is the product nobody has built.