Policy Cards

Audit is a boring word until the system being audited can move money, approve a refund, escalate a medical triage queue, book logistics capacity, or quietly call six APIs before breakfast. That is the mood shift around AI agents. The question is no longer whether a model can produce a clever answer. It often can. Congratulations to the stochastic parrot; it has learned to use tools. The harder question is whether an organization can prove, after the fact and preferably before disaster, that the agent acted within its assigned authority. ...

A bank does not usually fail because its compliance policy forgot to exist. It fails because the policy lived in one place, the software lived somewhere else, and the audit trail arrived after the damage had already developed a charming personality. That gap becomes harder to excuse when AI agents move from answering questions to initiating payments, recommending clinical escalation, coordinating mission plans, or calling APIs inside enterprise workflows. A chatbot can be corrected after the fact. An agent that acts on behalf of a firm needs rules before it acts, evidence while it acts, and review after it acts. The old governance ritual of “write a policy, publish a PDF, hope engineering read it” starts to look less like oversight and more like theatre with better stationery. ...