The System Carries the Responsibility, and Proves It on Demand
A property you can only assert is worth nothing in an audit. Vanta's list of nine things auditors want to see ends on "evidence, not policies": a document that says "we attribute every change to a human" answers nothing, because the auditor picks one change and asks you to show it. It is not enough for a system to have the seven properties. The system has to produce the proof of each one as exhaust from running normally, without anyone preparing for the question. That is the difference between "carries the responsibility" and "claims to."
The two mechanism pages before this one supply the substrate. Evidence as a byproduct shows that the append-only session log a crashed harness needs to resume is, byte for byte, the artifact an auditor samples. The four-axis audit query shows that every auditor question resolves to a slice of that log by task, actor, environment, and time. The responsibility a single human used to carry per change is now carried by the architecture, and the architecture can be made to prove it.
What a human personally vouched for becomes a property the system records
On a laptop, one person stood behind every change, and the proof was that person's word plus the git log under their name. At team scale, no human vouches for thousands of changes, so each promise has to be reissued as something the system records on its own. The substitution is one-for-one:
| The human's promise | What the system records instead |
|---|---|
| "It was me" | A distinct AI identity, bound to the initiating human |
| "I only touched what I needed" | Per-task least privilege; credentials never enter the sandbox |
| "It ran on my machine" | One isolated environment per task, placed where policy requires |
| "I reviewed it before merging" | Author never sole approver; gates enforced and recorded |
| "Take my word for it" | An append-only log, queryable by task, actor, and time |
The full version of why those five promises reopen once agents leave the laptop is the argument that opens this section. What matters here is the right-hand column: every entry is a recorded artifact, not an attestation. "It was me" is a borrowed token on a laptop and a logged identity in the team model. The point of the substitution is that the proof stops depending on a person being available to vouch for it.
The reports already build for the proof, even where they never say "compliance"
Brex names the attribution requirement as a governance principle: agent work "needs to be attributed back to an actual human and not just a bot." Anthropic's session log, the artifact a replacement harness reads to resume a dead sandbox, is also a complete external record of everything the agent did. Neither post uses the word "compliance," because both teams were building for resilience and attribution, and the proof fell out of that work.
Intercom is the existence proof that the byproduct survives a real auditor. Every AI-approved PR is "labelled, logged, and queryable," and they engaged Schellman before scaling to confirm the evidence meets SOC 2, HIPAA, ISO 27001, ISO 42001, and AIUC-1. Their close: "When you build for safety, compliance follows." Compliance follows because the evidence was already being produced for another reason.
One fence: Intercom is the only published first-party account of taking agent-driven change management through real audit frameworks, and no shipping platform fully meets the attribution bar yet. Per-initiating-human scoping of the AI identity is the standard to hold vendors to, not the current state of the market.
The test is a question nobody prepared for
"Carries the responsibility" is the weaker half of the claim until you can demonstrate it cold. The test is whether the system answers an unprepared question: pick any merged change, and the record yields the human who initiated it, the access the agent held, the environment it ran in, and the gate that approved it, in one query, without anyone having staged the answer in advance. If producing that answer is a project, the responsibility is not being carried by the system; it is being reconstructed by a person, which is exactly the thing that does not scale.
This is why the four-axis query is the read side of the audit trail property, not a nice-to-have. An auditor's question is always "show me everything that touched X between these dates," and a log you can only read linearly answers none of them on demand. The corpus is candid here: the underlying log often exists, but no vendor documents an auditor-facing, per-actor queryable interface over it. Build or buy, that read interface is the thing to demand, because it is the difference between proof on demand and a grep project before each audit.
Run the two artifacts against whatever you have today
The compliance checklist is the minimum bar for the system itself, an enforceable check across all seven properties. The 22 auditor questions are the interrogation the system has to survive, deduplicated from Schellman, A-LIGN, ISACA, IAPP, and the Big 4, each paired with the property and the evidence artifact that answers it. Run both against your environment. Wherever the honest answer is "the human at the keyboard would know," the responsibility is still sitting on a person. Demand the recorded property instead, and confirm the system produces it without a scramble.