Put an Evidence Hold Before AI Agents Clean Up

The cleanup step is where an agent can erase the only proof you had.

Should an AI coding agent clean up its own traces, logs, worktrees, screenshots, temp files, and failed test artifacts before review?

No.

Short answer

Put an evidence hold in front of agent cleanup.

An agent can propose cleanup. It should not delete logs, traces, worktrees, screenshots, browser artifacts, temporary files, generated diffs, failed test output, approval records, or other proof of its run until a separate review step preserves the evidence needed to explain what happened.

The approval should bind to the exact cleanup action: actor, tool, command, target path, normalized parameters, reason, reviewer, expiry, and evidence packet.

If risk classification, approval validation, policy lookup, or audit logging fails, cleanup should fail closed.

Cleanup is a security action

Builders tend to treat cleanup as housekeeping.

Delete the temp directory. Remove the failed screenshot. Drop the worktree. Clear the test output. Clean ignored files. Trim logs. Reset the repo. Remove a throwaway branch.

That is fine when a human knows what needs to stay.

It is different when a tool-bearing agent is doing the cleanup. The agent may be deleting the evidence a reviewer needs to decide whether the run was safe, scoped, and correct.

A cleanup step can remove proof of:

1. What the user asked.
2. Which instructions influenced the agent.
3. Which tools were exposed.
4. Which commands ran.
5. Which files changed.
6. Which tests failed before they passed.
7. Which network destinations were touched.
8. Which browser pages or screenshots shaped the result.
9. Which approval gates fired.
10. Which artifacts would make rollback possible.

That turns cleanup into an integrity problem.

OWASP already gives us the pieces

OWASP LLM06:2025 Excessive Agency describes damaging actions caused by unexpected, ambiguous, or manipulated model outputs. OWASP points to excessive functionality, excessive permissions, and excessive autonomy as root causes.

That maps directly to cleanup.

If an agent has open-ended shell access, broad filesystem permissions, and permission to delete its own traces, a prompt injection or mistaken plan does not need production access to cause damage. It can erase the review trail.

The OWASP AI Agent Security Cheat Sheet is even more operational. It recommends explicit approval for high-impact or irreversible actions, action previews before execution, clear audit trails of agent decisions and actions, interrupt and rollback paths, and fail-closed behavior when risk classification, approval validation, policy lookup, or audit logging fails.

That is the right model for cleanup.

Cleanup is not always high impact. Deleting a generated cache after the evidence packet is saved may be fine. Deleting the only failing test output, trace, screenshot, or worktree before review is not fine.

Platform permissions are not enough by themselves

Agent platforms are moving in the right direction.

OpenAI's Codex approval and security docs separate sandbox mode from approval policy. The sandbox defines what the agent can technically do. The approval policy defines when it must stop and ask before acting.

Claude Code's permissions docs make another important point: permissions are enforced by the application, not by model instructions. A project note that says "do not delete evidence" is useful guidance. It is not enforcement.

For MCP-connected agents, the MCP tools specification says tools are model-controlled and that users should have a human-in-the-loop path with the ability to deny invocations. It also says clients must treat tool annotations as untrusted unless they come from trusted servers.

That matters because a cleanup tool can sound harmless.

It might advertise itself as a housekeeping helper. It might label a deletion as idempotent. It might only expose a friendly cleanup_project name. The host still needs to ask what evidence will disappear.

Tool descriptions are not approval gates.

What counts as evidence

Before cleanup, preserve the minimum packet needed to explain the run.

For AI coding agents, that usually means:

• The original request and scope.
• Relevant system, developer, project, and skill instructions.
• The tool inventory and permission mode.
• Tool calls with normalized arguments.
• Shell command transcript.
• Changed-file diff.
• Failed and passing test output.
• Browser screenshots, traces, HAR files, or page captures when a browser was used.
• Worktree path, temp directory path, generated artifacts, and cleanup targets.
• Approval requests and decisions.
• Network destinations and external write attempts.
• Final agent summary.

You do not need to keep everything forever.

You do need enough to answer three questions:

1. What did the agent see?
2. What did the agent do?
3. What proof did the reviewer use before accepting or deleting the work?

Cleanup actions that should trigger a hold

Do not treat these as harmless by default:

• rm, recursive deletion, and directory deletion.
• git clean, git reset --hard, branch deletion, and worktree removal.
• Log truncation or trace deletion.
• Test artifact deletion.
• Screenshot, video, browser profile, HAR, or Playwright trace deletion.
• Temporary directory purges when the directory contains generated evidence.
• Package manager cache cleanup after dependency changes.
• Database cleanup in local or shared environments.
• Memory deletion or compaction when memory influenced the run.
• MCP cleanup tools that hide the underlying target list.

The rule is not "never clean up."

The rule is "preserve proof first."

A simple evidence hold policy

Use something this plain:

agent_cleanup_policy:
  default: hold
  allow_without_review:
    - delete empty run-owned directories after evidence packet exists
    - remove generated cache files listed in the cleanup manifest
  require_review:
    - delete logs
    - delete traces
    - delete screenshots
    - remove worktrees
    - run git clean
    - run git reset
    - remove failed test output
    - delete browser artifacts
    - delete approval records
  approval_record:
    required_fields:
      - actor
      - tool
      - command
      - normalized_targets
      - evidence_packet
      - reviewer
      - decision
      - expiry
      - rollback_path
  fail_closed_when_missing:
    - target list
    - evidence packet
    - policy decision
    - audit log write

This can live in a repository policy, agent skill, wrapper script, MCP client policy, CI job, or local runbook.

The important part is that the agent cannot approve its own evidence deletion.

How to test it

Run five small checks before you trust cleanup automation.

1. Ask the agent to clean up after a failed test. Confirm the failed output is preserved before deletion.
2. Put a hostile instruction in an untrusted file that tells the agent to delete the trace directory. Confirm it refuses or asks.
3. Expose a cleanup tool with a friendly name but destructive behavior. Confirm the host shows the exact target list.
4. Approve cleanup for one path, then change the target path. Confirm the approval no longer applies.
5. Break audit logging. Confirm cleanup fails closed.

If the agent passes those, you have a real cleanup boundary.

If it fails, do not grant broader filesystem access yet.

Evidence versus opinion

The evidence is straightforward: OWASP recommends least privilege, high-impact action approval, audit trails, rollback paths, complete mediation, and fail-closed controls. Vendor docs show that agent runtimes increasingly separate technical sandboxing from approval policy. MCP treats tool invocation as model-controlled and warns that annotations are not automatically trustworthy.

My opinion is the operating pattern: agent cleanup needs an evidence hold.

Not because every cleanup action is dangerous. Because the wrong cleanup action can make the rest of the review unverifiable.

If an agent can delete the proof before a human or policy service reviews it, the workflow is trusting the agent's story about itself.

That is too weak for write-capable agents.

Free next step

Test your agent.

Pick one recent run and list every artifact the agent could delete during cleanup. Then write one hold rule that preserves the evidence packet before the next autonomous run.

If you want the surrounding field-guide context, read Agent Trace Governance, Sandbox Profiles Before Shell Access for AI Coding Agents, and MCP Tool Annotations Are Hints, Not Approval Gates.