The 22 Auditor Questions: 17 the Architecture Answers, 5 It Cannot

Auditors will ask 22 distinct questions about your coding agents, and the architecture answers 17 of them with artifacts it already produces. The remaining five it cannot answer, and no environment design will save you from them. It deduplicates roughly 60 raw question instances from 10-plus sources into those 22 canonical questions, and for each one names who asks it, which of the seven compliance properties answers it, and the evidence artifact the reference architecture produces.

Ten-plus sources feed the list:

• Schellman. The first ANAB-accredited ISO 42001 certification body and first accredited AIUC-1 auditor.
• AIUC-1 standard. The standard itself.
• A-LIGN. Governance guidance for AI agents.
• ISACA. "The Growing Challenge of Auditing Agentic AI" (Sep 2025).
• IAPP. AI governance in the agentic era.
• Vanta. AI agent audit preparation.
• Kognitos. The SOX auditor question list.
• Teleport. SOC 2 mapping for AI agents.
• Deloitte and KPMG. Public internal-audit guidance.

One caveat up front: the AI-generated-code questions (notably Q11) come from vendor and SEO pages, not audit firms. As of June 2026, no major audit firm has published a dedicated AI-generated-code FAQ.

Two stats frame the whole list:

• Most-asked property. The audit trail appears in six-plus questions and in every single source organization. "Show me the trail for a specific decision" is the universal auditor move.
• Least-asked property. Isolation: only AIUC-1's Q2-2026 update raises execution-environment sandboxing explicitly, which means an isolated-by-construction environment currently answers questions auditors are only beginning to ask.

The profession is gearing up. ISACA launched its Advanced in AI Audit certification in May 2025 (90 scenario-based questions), and its 2025 AI Pulse Poll found 70% of audit professionals expect to need materially increased AI skills within a year.

Questions 1–3: who owns the agent, and is its identity real?

1. What AI agents do you have, where do they run, and what systems can each connect to? Asked by Vanta, A-LIGN, Kognitos. Property: none. This is the inventory gap, and it is the most-asked first question. The architecture helps but does not close it: the platform's task and session registry is a complete inventory of every agent it runs, with the systems each environment was provisioned to reach. Nothing in the architecture forces discovery of agents running outside it, on laptops or in shadow tooling.

2. Who owns each agent, and who is accountable when it acts autonomously? Asked by ISACA ("Who owns an AI decision? If an agent takes autonomous action, who is accountable?"), Vanta, AIUC-1, Schellman. Property: attribution, partially. Evidence artifact: the task-creator binding. Every session is scoped to the human who initiated it, so "this change exists because this person asked for it" is a database lookup. The organizational half of ownership (who owns AI governance, which Schellman reports clients asking directly) is policy, not architecture.

3. Is every privileged action attributable to an accountable identity, human or agent? Do agents have unique, verifiable identities? Asked by Teleport ("auditors will often treat 'no human request' as a major accountability gap"), ISACA, AIUC-1 (A003.3 requires "unique, cryptographically verifiable agent identities"). Property: attribution. Evidence artifact: a distinct synthetic AI identity per agent, with a per-session token bound to the initiating human. Commits, PRs, and approvals carry the identity that performed them; the answer to "who did this?" is never "the bot."

Questions 4–5: show me the trail

4. Show me the audit trail for a specific agent decision: inputs, trigger, reasoning, action, who reviewed it. Asked by Kognitos, Vanta, Teleport, ISACA, AIUC-1. The single most universal question in the corpus. Property: audit trail. Evidence artifact: the session event log, append-only and stored outside the sandbox, capturing the prompt, every tool call with inputs, the review decision, test results, and the merge event. ISACA's warning applies to systems without it: "agentic AI does not offer human-readable reasoning unless explicitly programmed to log it."

5. Are those logs tamper-evident and complete across the whole audit period? Asked by Teleport, AIUC-1, and the AI-code corpus (a SOC 2 Type II auditor samples across the full 12-month window). Property: audit trail. Evidence artifact: the log is external and append-only by construction; it survives sandbox destruction and cannot be quietly rewritten, and it exists for every task because it is also the system's resume-after-failure mechanism. You did not build it for the auditor, which is exactly why it is complete.

Questions 6–8: are boundaries enforced by constraints or instructions?

6. For every action the agent is not authorized to take, is that enforced by a technical constraint or an instruction? Asked by A-LIGN (verbatim), echoed by Vanta (an agent "allowed to issue refunds under $100" must be technically prevented above) and AIUC-1. Property: least privilege. Evidence artifact: the per-task provisioning record plus egress control. A credential that was never provisioned into the environment, and a network path that does not exist, are constraints. A system prompt is an instruction.

7. What data can the agent read, and is access minimized to what the task requires? Asked by Vanta and AIUC-1. Property: least privilege. Evidence artifact: per-task scoping. Each environment gets the repo access and secrets that one task requires, nothing ambient, and the provisioning manifest shows it.

8. Are agent privileges scoped and time-limited, and reviewed like privileged users? Asked by AIUC-1 (A003.4: "just-in-time permissions, to limit the scope and duration of agent privileges") and Kognitos (AI agents with admin permissions treated as privileged users). Property: least privilege. Evidence artifact: per-session tokens that live exactly as long as the task, plus credential scrubbing before any environment image is snapshotted.

Questions 9–12: who approves, and who can change the agent

9. Which actions require human approval before they take effect? Show me the decision-authority matrix. Asked by Kognitos, Vanta, Deloitte ("human-in-the-loop overrides"), AIUC-1. Property: segregation of duties. Evidence artifact: the encoded workflow itself. The handbook declares which steps are AI and which park at human gates, and auto-approval thresholds by risk are configuration you can print, not tribal knowledge.

10. Can you prove the human review of AI output was substantive: reviewer, timestamp, scope, attestation? Asked by Kognitos, KPMG ("defining when and how validation, judgment, and other procedures must be applied"), and the AI-code corpus. Property: segregation of duties plus audit trail. Evidence artifact: the recorded review step, with the reviewer's identity, timestamp, decision, and comments, and the structural fact that a rejected review fails the task rather than being advisory.

11. How do you know what code was AI-generated? Asked by the AI-code vendor corpus only, which is the caveat. No audit firm has published this question, though the corpus reports auditors reject policy-only answers ("engineers must label AI commits") in favor of logging at the point of generation. Property: attribution. Evidence artifact: AI work is committed under the AI identity, never a borrowed human token, so AI-authored versus human-authored is distinguishable in git history itself, retroactively and at scale.

12. Who can modify the agent (prompts, logic, model), and how is that access reviewed? Asked by Kognitos and ISACA. Property: least privilege plus segregation of duties. Evidence artifact: workflow definitions and environment images are versioned and access-controlled, so changing what the agent is goes through the same change management as changing what it writes. The periodic access review on top of that is an operational control you still have to run.

Questions 13–15: what version ran, and can you reconstruct it

13. How is agent logic version-controlled? What version ran on date X, and what was it capable of? Asked by Kognitos, A-LIGN ("can your organization demonstrate, for any deployed agent, what it was capable of at any point in the past six months?"), ISACA ("version control for agent logic treated as code"). Property: reproducibility. Evidence artifact: every session records the versioned image, harness, and model it ran against. "What was it capable of on March 3" is a query.

14. How do you handle upstream model changes? Are agent updates change-managed like releases? Asked by Kognitos, A-LIGN (treat agent updates "like product launches, not software patches"), Teleport. Property: reproducibility plus segregation of duties. Evidence artifact: a model or harness change is an image version bump that flows through the same gated process, and the session log shows which version every task used before and after.

15. After an incident, can you reconstruct what the agent did and why? Asked by A-LIGN ("could your organization reconstruct what it did and why?"), Kognitos, Teleport. Property: audit trail plus reproducibility. Evidence artifact: replay the session log against the versioned image and you have both the full action sequence and the exact conditions it ran under. The audit record of any takeover is part of the same trail.

Questions 16–17: sandboxes and kill switches

16. Are agent execution environments sandboxed? Are MCP servers approved, authenticated, and logged? Asked by AIUC-1's Q2-2026 update almost exclusively (B006: approved-server restrictions and runtime sandboxing; B008: agent-to-agent message signing plus MCP tool-call I/O integrity; D003.3: tool-call logging including "MCP server-level metadata like tool name and input parameters"). Property: isolation. Evidence artifact: one isolated environment per task, the brain/hands split keeping credentials out of the sandbox, and every tool call logged with inputs in the session record. Auditors have not yet internalized this question broadly; this standard is where they are headed.

17. How do you stop or override a misbehaving agent: kill switch, rollback plan, escalation path? Asked by Vanta, A-LIGN (kill-switch authority), Teleport (expects "a rollback plan" for AI-driven changes), Deloitte. Property: isolation plus segregation of duties. Evidence artifact: containment is environment teardown. Destroy the sandbox and the agent has no hands; the branch, session log, and task state persist for a human to pick up. The escalation path is the always-available human gate.

Questions 18–21: the four the architecture does not answer

State these four plainly.

Question 1 (inventory) belongs on this list too, making five gaps in total: inventory, drift, risk assessments, adversarial testing, and vendor due diligence.

Question 22: evidence, not policies

22. Can you show evidence the controls operated continuously, not policy text saying they would? Asked by Vanta ("evidence, not policies"), AIUC-1 ("system-level logs showing controls were active between audit cycles"), Kognitos. This is the meta-question behind the other 21. Property: audit trail. Evidence artifact: everything above is produced by the system operating, not by a human preparing for an audit. The session log exists because tasks ran; the identity binding exists because tasks could not start without it; the gate records exist because the workflow could not advance without them. That is evidence as a byproduct.