Takeover Corrupts the Audit Record Unless the Environment Logs the Seam

When a human takes over an agent's task mid-flight, the audit record loses the seam between AI authorship and human authorship at exactly the moment it matters most. Git records the committer of the final commit, not who held the controls when each line changed, so the diff confidently attributes the human's correction to the agent or the reverse. The fix is environmental, not procedural: the control transfer has to be a logged session event, and no shipping product writes that event today.

The capability gap underneath this is measured. In a 2026 KAIST study of human-agent co-creation (arXiv 2603.02050), 31.8% of 214 turn-level interactions involved the human acting concurrently with the agent, and the agents could not handle it: in the words of the paper's abstract, they "lacked the collaborative context awareness needed to distinguish user feedback from independent parallel work." That study ran in a design domain, not a coding one, so treat the exact percentage as indicative rather than transferable. The gap itself is the one every takeover feature in the coding-agent market ships with today. An agent that cannot tell a correction from a contribution produces a record that cannot tell them apart either.

The misreading corrupts the record in both directions

When a human steps into an agent's task mid-flight, two actors are now editing one workspace. The attribution failure has two shapes, and shipping products exhibit both.

Direction one. Human work gets recorded as AI work. The human fixes three lines in the agent's branch; the agent resumes, absorbs the fix into its working state, and the next commit goes out under the agent's identity. The human's contribution is now invisible. Cursor's cloud agents document the resume explicitly, "Release control back to the agent for it to keep working" (Cursor docs), but nothing in that mechanism writes down what the human did while in control. One Cursor forum user put the consequence plainly: the two-layer model "means there are more chances for the agents to obfuscate or miss what actually happened."

Direction two. AI work gets recorded as human work, or human work gets recorded under the agent's machine. Devin's "Use Devin's Machine" opens an editor and terminal inside the agent's VM, because, as Cognition's product update says, "it can sometimes be more convenient to directly take actions for Devin." Convenient, and ambient: keystrokes typed in the agent's environment run under whatever identity that environment carries. Claude Code's teleport runs the inverse trade, pulling the agent's branch and conversation into the human's terminal (docs), where everything that happens next commits under the human's token, including work the agent does after resuming.

Either way, the compliance property this guide calls attribution, that human-authored and AI-authored are always distinguishable in the record, fails silently at exactly the moment it matters: the moment a human judged the agent's work wrong enough to intervene. See attribution.

A wrong label is worse than no label

Intercom's bar for AI-driven change management is that every decision is "labelled, logged, and queryable" (Intercom). A takeover that blurs authorship breaks the label while leaving the log intact, which is the dangerous case: the auditor gets a confident answer that is false. Segregation of duties is the control that breaks first. If a reviewer fixes code inside the agent's session and the fix is absorbed into an AI-authored commit, that reviewer is now approving their own work and the record shows otherwise. The author-never-approver rule only holds if the record knows who the author was.

Git alone cannot hold the seam. Blame shows the committer of the final commit, not who controlled the environment when each change was made. The diff is the wrong artifact. The session event log is the right one, because it is the only record that exists at the moment of the transfer itself.

Mark the seam as an event, not an inference

The fix is environmental, and it has a clear shape:

• Logged transfer. Control transfer is a first-class logged event. Take-over and release each write a timestamped entry to the session log: who took control, when, and when they gave it back.
• Carried identity. Every action between those events carries the controlling identity. The human and the AI hold distinct identities inside the same environment; neither borrows the other's.
• Commit authorship follows the controller. Changes made under human control are committed as the human, even when the agent later pushes them.
• Resume annotation. The resuming agent is told what changed. The 2603.02050 authors built CLEO, a probe that classifies a concurrent human action as feedback or independent work. The classification the agent needs is the same annotation the audit record needs. One mechanism serves both.

The field has not written this

Our literature sweep found zero sources, vendor, practitioner, or academic, that connect manual takeover to attribution at the moment control changes hands. Cursor's release-control and Imbue Sculptor's live pairing sync are the clearest shipped reverse-seam mechanisms, and neither writes an attribution record. Ramp's Inspect writeup gets closer on shared prompting by saying each prompt that causes code changes should carry that person's authorship info, but it does not describe the audit event for a human manually editing inside the session. Distinct AI identities solve the actor label at task start; they do not, by themselves, mark the mid-task control transfer.

The transfer mechanics that make takeover possible at all are the four-transfer standard; what the agent should do on resume is mixed initiative. A takeover that ships those two and skips the attribution event still hands the auditor a confident, wrong answer to "who wrote this?"