Tracing Recurring Agent Pathways: Evidence-Centered Visual Analytics for Intervention Design

Abstract

Agent activity logs interleave routine delegation, file operations, and external actions, making a single anomalous output difficult to relate to its upstream pathway. We present an evidence-centered vi- sual analytics workflow for VAST Challenge 2026 Mini-Challenge 2. Starting from a file-backed SaidIT post, a time-decreasing re- verse trace reconstructs its instruction lineage; coordinated tem- poral, organizational, and comparative views then expose a ter- minal signature shared by three occurrences. The same work- flow identifies an observable review point before delegated in- structions execute. A paired simulation compares no interven- tion, tiered delegation review, and terminal precommit review over 192,000 replays. The analysis supports recurring file-driven be- havior and an upstream intervention, while explicitly withholding claims about deleted payload semantics or intent. The contribu- tion is a provenance-preserving workflow that connects anomaly re- construction, recurrence comparison, and intervention assessment without obscuring the boundary between observation and infer- ence.