The Seven Properties: Compliance Is a Property of the Architecture

Six of the seven properties an auditor needs are already in the published record. Anthropic's architecture supplies four, Brex names attribution, and Intercom proves segregation of duties with 93% of pull requests agent-driven (Intercom). The seventh, dependency provenance, is this handbook's prescription, and no vendor ships it today.

None of the seven is a certificate you bolt on after the work is done. Each is a property the environment and the workflow must have by construction. The compliance question the laptop dodged is an architecture question, and a system built with these properties produces the evidence as a byproduct of running normally rather than as a quarterly scramble.

Each property below points back to the mechanism that produces it.

Attribution: every change resolves to an AI identity bound to a human

Brex states the principle flat: work "needs to be attributed back to an actual human and not just a bot" (Brex). The mechanism lives in the workflow. AI work runs under a distinct agent identity, never a borrowed human token, and that identity is bound to the human who initiated the task. "Who did this?" then resolves to a real entity, and AI-authored versus human-authored stays distinguishable in the record. No shipping platform fully meets the per-initiating-human bar today, so this is the standard to hold. Full chapter: Attribution.

The audit trail is the session log, kept external and queryable

Anthropic's session is an append-only event log stored durably outside the containers (Anthropic). The artifact that makes the system resilient, a log you replay to resume after a crash, is the same artifact that makes it auditable, which is why this property is produced by the session rather than added on top of it. Every step is recorded: the prompt, the agent's actions, the review decision, test results, the merge event. Intercom set the bar with every decision "labelled, logged, and queryable" (Intercom), because an auditor's question is always "show me everything that touched X between these dates." Full chapter: Audit trail.

Least privilege: credentials never reach the sandbox where model code runs

Anthropic's structural fix is that "the tokens are never reachable from the sandbox where Claude's generated code runs": auth is bundled with a resource for one-time initialization, or held in a vault and fetched through a proxy the model never touches (Anthropic). The model can write any code it wants and that code still cannot read a credential. The property comes from how the perimeter handles credentials and secrets: each task gets only the access it requires, secrets are split-trust at rest, and per-identity credentials are scrubbed before any environment is snapshotted, as a hard gate that aborts the snapshot on failure. Full chapter: Least privilege.

Isolation and residency: where code runs is a placement policy

One isolated environment per task, with no cross-environment communication, means one task's code and data cannot leak into another's. The brain and hands separation lets reasoning run against hands inside a customer's own VPC without network peering, which is how you satisfy "the code never leaves our perimeter." Because environments are regionally placeable, GDPR-style data residency is a placement decision, not a re-architecture. Full chapter: Isolation and residency.

Segregation of duties: the author of a change is never its sole approver

SOC 2 change management requires that the entity making a change is not its sole approver. The workflow delivers this through review as a gate: AI writes, a separate gate approves, whether an automated multi-agent reviewer, a required human approval, or both, and the gate action is recorded. Intercom's reviewer refuses to approve large PRs, making scope discipline a control rather than a style preference, and any engineer can pull any change into human review at any time. At Intercom, 19% of PRs were auto-approved with zero reverts in the 100-PR pilot (Intercom). Full chapter: Segregation of duties.

Reproducibility: the change process is encoded, not aspirational

Environments are built from versioned, known-good images, so the exact conditions a change was produced under are reproducible on demand. The defined task sequence, write then review then approve then ship, is the change-management policy in executable form. You can show an auditor the policy and the evidence it was followed for every task, because the same process ran every time. Full chapter: Reproducibility.

Dependency provenance: nothing installs on the model's say-so (the one nobody ships)

This property is a prescription. No vendor ships the control today, and the gap is measured. A USENIX Security 2025 study found 19.7% of packages recommended across 576,000 LLM code samples did not exist, and 43% of hallucinated names recurred on every run, which is exactly what makes pre-registering them as malware pay off for an attacker (Socket on slopsquatting). The Nx s1ngularity attack went the other way: a poisoned version of a trusted package ran a postinstall credential harvester that drove installed AI CLIs with --dangerously-skip-permissions (Nx advisory). The fix has a clear shape: deny-by-default registry access, a release-age cooldown for new versions, and a dependency diff surfaced at the review gate, where the workflow already treats a request to add a package as a claim to verify, not an authorization (see hallucinated dependencies). Full chapter: Dependency provenance.

The properties at a glance

Three pages take the seven properties further:

• Four-axis audit query. Asks the properties their question, by task, actor, environment, and time.
• Framework mapping. Lines the seven up against SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, and AIUC-1.
• Compliance checklist. The condensed evaluation form.