Conventional execution traces record what an agent did, but do not by themselves establish whether the evidence supporting a consequential action was authoritative, current, and sufficient for a specified policy decision. This study develops the Evidence to Policy Assurance Graph (EPAG), a typed representation linking sources, qualified evidence, claims, policy predicates, compliance determinations, authorizations, executed actions, and observed outcomes. A design-science process drew on 38 selected sources and evaluated a constructed $250,000 funds-transfer fixture. The evaluation comprised one valid baseline (S0), five single-condition perturbations (S1–S5), and six predefined criteria: completeness, qualification, localization, determinacy, reconstruction, and separability. The baseline satisfied all six criteria under the fixture rules. The perturbations exposed separate failures involving stale ledger evidence, a non-authoritative spreadsheet, insufficient funds, a missing second approval, and an execution amount that differed from the authorization. Each failure mapped to a defined primary disposition and, where applicable, a follow-up action. The 629 AgentDojo security cases and 144 ToolEmu cases cited in the paper provide published risk context; none was rerun or evaluated with EPAG. These findings establish representational adequacy for six constructed graph instances, not measured performance in a deployed system or proof of regulatory compliance. Independent studies must test tool-gateway enforcement, decision errors, audit-path reconstruction, latency, throughput, storage costs, and adversarial behavior.