How should an environment separate what an agent sees from what actually exists?

Model an observation layer separately from the complete environment state. The world state can contain the underlying cause of a discrepancy, while the agent receives only records its current role can retrieve. This distinction makes investigation meaningful.

A generated package could define `world_event_id`, `record_id`, `visible_to_role` and `discovered_at_step`. An invoice may be visible immediately, while a supporting service log becomes visible only after an authorised request. The event identifying the true cause belongs in evaluator state, not in the invoice payload.

Tools such as `list_requests`, `read_record` and `request_supporting_evidence` should return role-appropriate observations. Avoid fields such as `is_erroneous` or filenames that reveal the intended answer. Even an error message can leak hidden state if it names evidence the agent cannot access.

On reset, restore both business state and the agent's discovery history. Evaluation hooks can then distinguish a justified correction from one that happened to reach the right value without obtaining the evidence required to support it.