Who Audits the AI? Not the Company That Sold It to You.

Your agents took some actions this week. Somebody will eventually ask whether they took the right ones, in the right order, with the approvals that were supposed to happen. Look at who is offering to answer that question and you will notice something: almost all of them also sold you the thing being asked about. That is not a competitive observation. It is a disqualification, and it is older than any of this.

The rule you already accept

Nobody lets a company's own finance team sign off its accounts. Nobody accepts an audit from a firm the client controls. This is not a matter of taste or vendor preference — auditor independence is written into statute in every developed economy, enforced by professional bodies, and backed by rotation requirements designed to stop even long familiarity from softening a judgment.

The principle underneath is simple enough to state in one line: the party being measured does not get to own the instrument.

You already believe this. You would not accept a restaurant's own hygiene certificate, a builder's own producer statement with no council inspection, or a drug trial run and reported solely by the company selling the drug. Apply the same standard to the systems now taking actions on your behalf and most of the market disqualifies itself.

Test one: does the measurer have a stake in the verdict?

An agent vendor is conflicted in both directions. Lenient with its own agents, because a finding of failure is a finding about their product. Severe with a competitor's, because a finding of failure is a finding about a rival. Either way, the verdict carries the interests of whoever issued it.

This is worth saying carefully, because the engineering coming out of those companies is good and getting better. Microsoft's Agent Governance Toolkit evaluates policy at runtime before a tool call executes and writes hash-chained, tamper-evident audit entries. That is real work, done well, and it is open source.

It is also, by their own account, not the same object. From the project's own public discussion of policy enforcement versus decision evidence:

“What we don't do yet is treat the decision as a sealed, independently verifiable artifact.”

“Right now the decision and evidence are embedded in the audit trail rather than being first-class objects you can pass around or verify externally.”

microsoft/agent-governance-toolkit, Discussion #276

Note the word yet. That is a roadmap gap, and roadmap gaps close. A company of that size can build sealed, portable, externally verifiable evidence any quarter it decides to.

And it will not help. That is the whole point of an eligibility argument over a feature argument. Shipping the capability does not remove the conflict, because the conflict was never about capability. When the evidence that Microsoft's agents followed the required process is produced and signed by Microsoft, the artefact is a statement by an interested party, however excellent the cryptography. A feature gap can be closed by engineering. A structural conflict cannot be closed by anything the conflicted party does.

Test two: who produced the record?

The second test is harder and it clears out most of what survives the first.

Observability platforms pass test one — they are framework-agnostic and have no stake in whether any particular workflow succeeded. But their evidence comes from an SDK running inside the customer's own application, recording what that application chooses to report. The party being examined is also the party writing the account. That is a diary, not a witness. Excellent for debugging. Worth very little to a regulator.

Orchestration frameworks fail both tests at once, and fail them harder than the model vendors do. A framework whose central promise is that it enforces step order cannot also be the independent confirmation that the order held. That is the doer vouching for the doing. It is the same reason the person who performed a procedure does not get to witness their own compliance with it, and the reason a signature and a countersignature are required to come from two different hands.

What passing both tests actually requires

Passing test two is not a matter of being trustworthy. It is architectural. The record has to be produced by something that sits in the path of the action rather than alongside it — where the step does not execute unless the check returns permission, so the evidence is a precondition of the action rather than a report written about it afterwards.

A library that observes from inside the application can never make that claim, no matter how independent its vendor. It sees what it is shown.

And the artefact has to be portable: signed, self-contained, verifiable by a third party who trusts neither the operator nor the vendor and holds no account with either. Evidence embedded in someone's audit trail is evidence you have to ask permission to examine. That is the distinction Microsoft's own maintainers drew, and it is the right one.

Now run the test on us

An argument like this is worthless if the party making it exempts itself, so here is where we stand against our own two tests.

Test one, cleanly. We do not sell agents, models, or an orchestration framework. There is nothing in our catalogue whose reputation a DENY could damage. We have no stake in any verdict we issue, and structurally we cannot acquire one without ceasing to be what we are.

Test two, cleanly. The gate sits in the execution path. A step is not permitted until it is checked against a sequence declared before the run began, and the receipt is a signed, portable object with its own preimage published, verifiable offline by anyone with no account and no permission.

And the part that is not clean. We currently hold the signing keys. That is the honest limit on everything above, and we would rather say it than have you find it: an auditor who keeps the client's working papers in their own drawer is independent in the way that matters least. Every sealed run is copied to a separate write-once archive under a different credential, which means an altered record can be caught by comparison rather than taken on trust. That closes part of it. The rest closes when the keys are held by someone who is not us, and that is work in front of us, not behind us.

We would rather publish that sentence than be asked it in a meeting.

Three questions

You do not need to take our conclusion. Take the test and run it yourself on anyone selling you agent governance, including us:

Do you also sell the thing being measured? The agents, the models, or the framework that runs them.

Who produces the record? Your system, or mine reporting on itself.

Who holds the keys, and can I verify anything without asking you?

A vendor who answers all three cleanly is rare. A vendor who cannot answer them at all is selling assurance, which is a feeling. Evidence is something a stranger can check, and the first requirement of evidence has never been that it is accurate. It is that the person who produced it had nothing to gain.

Related reading: When an AI Agent Skips a Step, Your Audit Log Shows a Clean Run · Self-Signed Evidence · Provable Human Oversight · Security