You Can Hold the Log and Still Not Hold the Evidence

OpenAI’s Responses API stores responses by default, and its documentation says response objects are retained for at least 30 days by default. Google made the same call: the new Gemini Interactions API defaults to store: true, and as Earendil Engineering documented it in July 2026, “on the paid tier interactions are retained for 55 days, and on the free tier for one day.” Both numbers are vendor defaults that can move next quarter. That mutability is the point.

Every governance control worth having rests on a record you can inspect. Trace what the agent retrieved. Reconstruct why it acted. Prove what the operator knew and when. We have written about the session log as the cheapest audit trail an operator can keep, and about what happens when those logs become discovery material in litigation. Both arguments assume the record is obtainable.

That assumption is now failing in production, quietly, through a set of shipping decisions nobody framed as a governance change.

What the Provider Keeps and What You Get

Earendil Engineering’s framing is the sharpest I have read on this: “Together all of these things change the ownership reality of an AI session: the transcript on your machine is no longer your session but a partial view of a session whose operational state belongs to an inference provider and not you.”

Four mechanisms produce that partial view.

Reasoning tokens arrive encrypted. Subagent message payloads are sealed in transit. Context compaction happens server-side with no readable account of what was dropped. Session state lives on the provider’s disk under a retention window the provider sets. Each was introduced for a defensible reason. Together they relocate the part of the record that carries intent.

The encryption detail is the one worth sitting with. As the piece puts it: “This encryption does not hide the data from the inference provider but it hides it from you.” The threat model here is not the vendor protecting your reasoning from itself. Anthropic published a post in February 2026 addressing alleged “distillation attacks” by DeepSeek, Moonshot and MiniMax, and that is the stated motive for sealing payloads. Competitive defense is a real interest. It is also an interest that happens to be satisfied by making the customer’s own trace unreadable to the customer.

A related change landed in the open-source Codex client in June 2026. The commit, titled “Encrypt multi-agent v2 message payloads”, does exactly what it says. An open issue asks for the encrypted delivery to retain a separate readable audit copy. The request is modest, it is unresolved, and its existence tells you the audit consequence was not designed in.

The Collision

Two things we have argued now sit on top of each other badly.

Keep a defensible trail. Assume your logs are evidence. Both counsels are correct, and both were written for a world where the operator could produce the record on demand.

Run the multi-agent case. An orchestrator delegates to four subagents. One of them retrieves a document, reasons about it, and returns a conclusion that shapes a decision with money or a regulator attached. Six months later somebody asks what that subagent actually saw. You have the orchestrator’s local event log, the final answer, and a citation list. The retrieval evidence, the filtering, the reasoning that connected them: encrypted, or compacted away, or sitting on a server past its 55th day. You held the log. You did not hold the evidence.

The same failure hits the deletion side. If you cannot enumerate what the provider stores, you cannot honor a deletion request, and you cannot tell a regulator what was retained. Legal hold works the same way. A preservation obligation you cannot execute against server-side state is not a preservation program.

The Standards Proposal Half

The Earendil post is signed institutionally, from rfc@earendil.com, with no individual author named. The address is a deliberate signal. This is pitched as a standard rather than a complaint, and the constructive half is where the leverage is.

Under “What a Portable Inference API Should Promise,” the lead-in is direct: “We would like inference providers and agent builders to adopt a small set of rules.” Seven of them.

1. The local event log is canonical. Server storage may mirror or accelerate it, but the client can reconstruct the session without dereferencing server IDs.
2. Storage is explicit. store: false should be easy, documented, and preferably the default.
3. No opaque item is the sole carrier of meaning. Encrypted reasoning, compaction, and tool signatures may be included for same-provider quality, but each has a readable, provider-neutral handoff representation.
4. Hosted tools have full-fidelity logs. Record exact inputs, outputs, evidence, filtering, provenance, timestamps, and content hashes, rather than only a polished answer and citations.
5. Subagent communication is auditable. Persist the exact readable task, messages, results, lineage, model, and tool permissions for every agent.
6. Compaction is inspectable. Return a readable summary, the instructions used to create it, and enough lineage to understand what was discarded.
7. Artifacts are exportable. Files, container outputs, search snapshots, and generated media can be downloaded into a content-addressed local archive.

Read that list as a procurement checklist and it stops being abstract. Principle 1 is a portability requirement. Principle 5 is the one that would have saved the multi-agent scenario above. Principle 2 is the only one you can act on today without any vendor cooperation at all.

Separately, the piece offers five tests for whether a session is yours: Inspection, Export, Replay, Audit, Deletion. Run them against your current stack this week. Most teams will fail Replay and Deletion on the first pass, and failing them is diagnostic rather than shameful.

Why the Commercial Argument Beats the Compliance One

The compliance framing gets you a policy document. The commercial framing gets you a contract clause, which is why I would lead with this line in any vendor conversation: “The option to leave also creates discipline. If a provider knows that a user can continue elsewhere, it has to compete on model quality, price, reliability, and trust. If the user’s accumulated context can only be interpreted by one provider, it sets very unfortunate incentives.”

That is the same dynamic we described as prompt debt hardening into model lock-in, arriving now through session state instead of prompt engineering. Accumulated context that only one vendor can decrypt is a switching cost you did not negotiate and cannot price.

A governance program that cannot read its own reasoning trace is also an oversight program running on summaries, which connects to what review coverage actually proves. Approving an output whose derivation you cannot inspect is a signature, not a review.

Do This Now

Set store: false where your workload allows it, and make the local event log the record of authority. That single change moves retention back under your policy instead of a vendor default, and it costs one API parameter.

Then run an inventory. For every agent workflow in production, write down which parts of the trace exist only on the provider’s side, and which of those carry reasoning rather than output. That list is your actual exposure, and most teams have never written it down.

Add the seven principles to your next vendor renewal as questions rather than demands. Ask what the readable handoff representation is for encrypted reasoning. Ask whether subagent messages persist in a form you can export. Ask what the retention window is today and what notice you get when it changes. Vendors answer procurement questions they ignore in blog comments.

Treat the 30-day and 55-day figures as documented at the time of that source’s publication rather than as stable facts. The specific numbers will drift. The ownership question underneath them will not.

---

This analysis synthesizes The Session You Cannot Take With You (Earendil Engineering, July 2026).

Victorino Group helps organizations build agent governance on records they can actually produce, from local event logs to vendor contract terms. Let’s talk.