A new arXiv paper names a gap that's been sitting in plain sight in agent-to-agent protocols: agents accept terms of service on their principal's behalf, but nothing in the protocol stack proves they actually followed those terms afterward. The paper, Anumati (Sanskrit for consent), draws a formal line between two things people have been treating as the same. As the author puts it, the calling agent "accepts the terms of service of the callee without any protocol-level mechanism to prove that it understood those terms or that it subsequently honoured them." The existing toolkit — OAuth, mutual TLS — solves a different problem. Those protocols establish who is allowed to call which capability, but they say nothing about the conditions attached to a permitted call, and those conditions shift as a callee's policies change over time. A token that authenticates identity and scope doesn't tell you whether the agent actually respected the fine print once it was inside the door. The paper's fix is to split "proof of acceptance" — a timestamped acknowledgment, basically a checkbox — from "proof of adherence," which is a per-action reasoning record that cites the specific clause the agent evaluated at the moment it acted. That's a meaningfully different artifact: not just "I agreed to your terms" but "here is the clause I checked before I did this specific thing, and here is the record of that check." To make this concrete rather than theoretical, the author proposes three primitives — PolicyDocument, ConsentRecord, and AdherenceEvent — that together form a versioned, append-only trail for agent-to-agent consent. Critically, this is designed as a non-breaking extension to two protocols already in wide use, A2A and MCP, rather than a rip-and-replace proposal. The paper backs the design with a TLA+ formal specification of the consent lifecycle and a reference Python implementation for validating chain integrity and adherence trails. The framing matters because it targets a specific failure mode: an agent can be fully authenticated, fully authorized, and still be non-compliant with the substance of what it agreed to, simply because nothing forced it to show its work. Anumati's bet is that accountability infrastructure needs a receipt for policy compliance, not just a signature for policy acceptance — and that this receipt has to live at the protocol layer, generated per action, or it won't survive contact with real deployments where terms change faster than anyone reads them.