External agents are already part of B2B work: buyer-side tools that summarize suppliers, diligence assistants that assemble questionnaires, internal copilots that draft replies. The characteristic failure is not that the answer is badly written. It is that nobody can say what the answer stands on.

Thesis. An agent that answers or acts on behalf of a business needs state whose attribution, currency, authority and responsibility can be checked at the moment of use — and "verifiable" in that sense is a narrower, more honest promise than "true".

Four pressures in real requests

Requests that touch commerce, compliance or diligence put four questions on every claim:

Attribution — Was this claim made by the supplier, by a laboratory, or scraped from a marketplace listing?
Currency — Did the certificate expire, or get withdrawn, after the PDF was indexed?
Authority — May this requester see the restricted annex, and may this agent say so on the company's behalf?
Responsibility — If the answer turns out to be wrong, who owns the correction, and how does the correction reach people who relied on the old answer?

Verifiable state, as we use the term, is a representation that keeps those four questions answerable. It is not a claim that the underlying facts have been proven true.

Why retrieval alone does not answer them

Retrieval-augmented generation (Lewis et al., 2020) and its graph-structured variants (Edge et al., 2024) are good at finding relevant text and relating entities. Modern memory and knowledge platforms can also carry permissions, versions and audit logs. The question is not whether such features can exist, but whether the system guarantees that an answer is blocked, qualified or escalated when attribution, currency or authority fail. A ranking function that happens to surface the right passage is not the same as a rule that prevents the wrong one from being asserted.

Language models also produce fluent text that is not supported by their inputs; the literature on this is extensive (Ji et al., 2023). Verifiable state does not fix model behaviour. It changes what the model is allowed to cite and what the surrounding system is allowed to do with the output.

What "verifiable" does not mean

A digital signature lets a verifier check that a holder of a particular key signed particular bytes, and that the bytes have not changed since. It does not by itself establish when the signing happened — that needs a separate time source, such as an RFC 3161 timestamp authority or a transparency log — and it says nothing about whether a factory is safe, whether a capacity figure is accurate, or whether the signer had authority to make the claim. Treating integrity of a record as correctness of reality is a category error. Proof Is Not Truth works through this distinction in detail.

The useful bar is narrower and still hard:

keep declarations, evidence and completed checks distinguishable;
keep history, withdrawal and revocation inspectable;
enforce disclosure boundaries at answer time, not only at file-access time;
refuse, qualify or escalate when support is missing, instead of inventing it.

What changes for an agent

When state is verifiable in this sense, an agent can do work a procurement or compliance team already recognizes:

answer from accepted, disclosable facts and cite them;
draft questionnaire responses with explicit gaps;
escalate commitments, conflicts and restricted material to a named human;
leave a response history that can be audited after the facts change.

An illustrative questionnaire (hypothetical)

The following is a constructed scenario, not a customer case or a measured result. A buyer sends a 120-question supplier questionnaire. Suppose 40 questions map to facts the supplier has already accepted for public disclosure, 20 depend on restricted evidence, 10 ask for future capacity commitments, and the remainder are ambiguous.

A system with verifiable state can route these differently: draft the 40 with citations, mark the 20 as requiring an authorized audience, send the 10 commitment questions to a human with authority to commit, and ask clarifying questions for the rest. A system without such state has no principled basis for treating these groups differently; whether it answers all 120 in the same tone depends on prompting and luck rather than on a rule.

Due diligence (hypothetical)

An investor's agent asks for ownership structure and recent regulatory actions. Public summaries may exist; sensitive annexes may not be disclosable to this audience. Verifiable state makes the refusal explicit ("exists, not disclosable to you") rather than omitting the annex silently while the answer still sounds complete. Note the design choice this implies: whether to reveal that withheld material exists is itself a disclosure decision.

Independent checks, not seals

Where an independent register exists — for example, accreditation-body certificate lookups such as IAF CertSearch for management-system certificates — an agent should be able to follow the evidence to it. That is a verification attempt with a dated result, not a seal of objective truth. A runtime can keep the linkage and the history of checks visible. It cannot replace every issuer's database or an on-site audit.

Counterarguments and limits

"Humans will check anyway." Often true for high-stakes answers. The point is to make the human's job tractable: a reviewer who sees evidence class, currency and audience per claim can approve or correct quickly; a reviewer who sees fluent prose has to redo the research.
Cost. Recording attribution, evidence and acceptance is more work than indexing documents. For brainstorming or private notes it is not worth it. The argument here applies where answers become commitments or disclosures.
Verifiable can still be wrong. A correctly attributed, current, authorized claim can be false — the issuer may have erred or lied. Verifiable state makes such errors traceable and correctable; it does not make them impossible.
No universal score. Different consumers legitimately weigh evidence differently. We do not think a single global trust score is a sound abstraction; a buyer's policy and a regulator's policy should be able to read the same history and reach different, explainable conclusions.

What this essay does not claim

This is a perspective. It is not a benchmark, and it makes no claim that any particular memory, search or ontology product lacks permissions or history. It claims only that, for agents acting in commercial and compliance contexts, the guarantees listed above should be properties of the system rather than hopes about retrieval.

Related Tinor work

Tinor's commercial products — Business Presence for maintained, source-aware public information and Business Response for grounded, human-gated replies — are built on this idea. How Tinor separates candidate interpretation from admitted state is the subject of Agent Memory Is Not Operational State and the forthcoming notes in the From Knowledge to State series.

References

Lewis, P. et al. (2020). Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. arXiv:2005.11401
Edge, D. et al. (2024). From Local to Global: A Graph RAG Approach to Query-Focused Summarization. arXiv:2404.16130
Ji, Z. et al. (2023). Survey of Hallucination in Natural Language Generation. arXiv:2202.03629
Adams, C. et al. (2001). RFC 3161: Internet X.509 PKI Time-Stamp Protocol (TSP). rfc-editor.org
IAF CertSearch. iafcertsearch.org