"What did the agent do?", answered with proof
Weeks after an incident, compliance asks exactly what happened and what stopped it. "Trust me" isn't an answer.
The per-domain activity trail and a signed, tamper-evident receipt: the action, the state it was checked against, and the verdict, recorded before anything ran.