An AI Audit Needs Evidence From the Moment of Action

Leading AI companies sign a voluntary control accord

President Donald Trump and leaders of major AI companies signed a voluntary accord on 29 September. Reuters and the Associated Press report that the agreement sets out four layers: internal controls during model training and deployment, an internal team responsible for those controls, an external auditor or evaluator, and an independent board committee overseeing the resulting reports.

The accord is described as morally binding rather than legally enforceable. It signals a shared direction for control and oversight, but does not set out a common audit methodology, detailed evidence standard or completed assessment of any signatory.

That distinction matters. External assessment and board oversight can only be as reliable as the operational evidence available to them.

An audit cannot recreate missing operational evidence

Consider an AI agent given a legitimate objective through an approved route. The expected route fails, so the agent replans, changes tools, discovers a credential or proposes a different command. A later reviewer may find fragments across prompts, tool logs, identity systems and the receiving platform.

Those fragments may show activity without establishing whether the action was authorised at the moment it was proposed. A useful operational record needs to connect:

• The model and agent version.
• The objective and governed context supplied.
• The consequential action proposed.
• The authority available for that action.
• The intervention or approval returned.
• Any replanning after a denial or change.
• The instruction that reached the executor.
• The result reported by the executor.

If those elements are not linked when the action occurs, an auditor may be left inferring authority from incomplete records after the event.

Control design and control operation are different claims

A documented policy can show that a control was designed. It cannot by itself establish that the control operated for a particular action.

Suppose an agent is permitted to update payment details for approved suppliers but must obtain additional approval when the beneficiary account changes. A policy may describe that requirement clearly. The operational claim still needs a linked record showing the supplier, the proposed change, the authority evaluated, the decision returned, any human involvement and the instruction ultimately executed.

That distinction gives an external evaluator something testable. It also helps an independent board committee separate evidence of control design from evidence of control operation, exceptions and remediation.

Board oversight needs bounded, attributable reporting

Useful oversight does not require exposing every prompt, proprietary model detail or item of personal data. It requires reports that are bounded to the control claim and attributable to the relevant systems and people.

A board committee could review how often protected actions were allowed, denied, modified or escalated; whether materially changed actions received fresh evaluation; whether an agent continued after a denial; whether expected evidence was missing; and whether remediation was completed and retested.

Those reports should identify the period, workflow, control version and evidence basis. Aggregation can support oversight, but reviewers still need a route back to the underlying records when an exception needs examination.

External evaluation needs evidence from both sides

A governed authority record can show why an action was allowed, denied or escalated. It cannot independently prove what an external system executed. The receiving system's logs can show an instruction or effect, but may not establish the authority under which it was proposed. Credible evaluation needs both sides to remain connected.

PF Systems' proposed role is to help create and preserve that connection. PF Memory supplies governed context. PF Kernel evaluates a proposed action. PF Core preserves linked evidence of the evaluation. ClientBridge connects systems without taking Kernel authority. PF Trace displays preserved evidence, and Proof Harness can qualify it against a defined exercise.

PF Systems does not audit or certify an organisation, guarantee safe operation, establish legal compliance or make the underlying AI deterministic. An independent evaluator would still need to define its scope, procedures, criteria and conclusions.

Begin before formal assurance

An organisation does not need to wait for a formal audit to test whether its evidence is usable. A controlled exercise can use synthetic actions, replayed proposals or a replica environment without allowing the AI to actuate a live consequential change.

The exercise can test whether consequential actions are described precisely, changes of target or method trigger fresh evaluation, a denial survives replanning, missing authority produces the intended intervention, the authority evaluation remains linked to executor evidence, and a reviewer can reconstruct the sequence without unnecessary disclosure.

That work would not certify the system or prove every future action safe. It would establish whether one defined control produces evidence that can be checked before an external evaluator or board committee has to rely on it.

The accord raises the profile of independent assessment and board oversight. Their credibility will depend on evidence created at the moment an AI system attempts to act.