Answering an auditor
Drill from any balance to the transaction, to the agent action that produced it, to the documents it read. External auditors get a read-only role with the same drill path.
AI governance
Six months from now an auditor will ask why a transaction was coded the way it was. If the answer is a model output nobody can reconstruct, you have a control weakness. Here is the record we write instead, for every action, at every authority level.
Most systems log that something happened. For automated financial activity that is not enough, because the interesting question is never whether — the transaction is right there in the ledger — it is on what basis. Each field below exists because a specific question gets asked about it later.
The agent, the model and its version, and the authority level in force at the moment of action. Model version matters more than people expect: when accuracy shifts, the first diagnostic question is whether the population of actions straddles a model change, and you cannot answer that retrospectively unless it was recorded at the time.
The trigger, the full set of source records read, and the extracted fields with their confidence scores. Recording what was read rather than only what was produced is what makes an error diagnosable. A bill coded to the wrong account because the agent never saw the purchase order is a different failure from one where it saw the PO and misjudged — different cause, different fix, indistinguishable without this field.
A short natural-language account of why the agent concluded what it did, written at the time of action rather than reconstructed afterwards. This is the field auditors engage with most and it deserves the caveats in the next section.
The named policy version evaluated, the deterministic result, the approver if one was required, and the resulting journal entry with its debits and credits. This is the chain that lets you assert control: not that the agent was sensible, but that a specific versioned rule permitted a specific action that produced a specific balanced entry.
A content hash written at insert. Records are append-only — corrections are new records referencing the original, never edits — so the trail can be verified rather than trusted.
A reasoning summary is the model’s account of its own decision. It is genuinely useful for investigation and it is not a formal proof of what occurred inside the model. We think stating that plainly is more useful than implying an interpretability we do not have.
This is exactly why the summary is not the control. The control is the policy evaluation, which is deterministic code with a versioned definition and a recorded result. If the reasoning summary and the policy result ever disagreed about what happened, the policy result is authoritative and the summary is a symptom worth investigating.
Audit records are retained for the life of the tenant and are not subject to the shorter retention that applies to operational logs. They export to CSV, JSON, or directly into your data warehouse on a schedule, because an audit trail you can only view in somebody else’s interface is a dependency rather than a record.
Prompt context is stored as references to your own records rather than as a copied blob wherever possible, which keeps the trail from becoming a second uncontrolled copy of your financial data. Where free text must be retained it inherits the same access controls as the underlying record — someone who cannot see a vendor cannot see an agent action about that vendor.
If you leave, the export goes with you in an open format. An audit trail that evaporates when a contract ends does not satisfy anyone’s retention policy, including ours.
What it is used for
Drill from any balance to the transaction, to the agent action that produced it, to the documents it read. External auditors get a read-only role with the same drill path.
When a coding is wrong, the record shows whether the extraction failed, the vendor match failed, or the policy was too loose — which determines whether the fix is data, a rule, or a threshold.
Straight-through rate, correction rate, and confidently-wrong rate are computed from the trail rather than estimated. The metrics and the evidence are the same records.
SOC 2 and any lender or sponsor diligence will ask how automated activity is governed. The export is the answer, and it does not require an engineer to produce.
Because straight-through rate is computed from these records rather than reported by the agents themselves, the number we publish and the evidence behind it cannot drift apart. A vendor whose accuracy metric comes from a different system than its audit log is asking you to reconcile two things that should be one.
Questions
We will send an anonymised audit export from a live tenant so your reviewer can assess the control, not the pitch.