The paper proposes an independence‑graded audit protocol for agentic AI systems, arguing that independence should be evaluated along three orthogonal axes: principal independence, substrate independence, and evidence independence. It introduces a seven‑step protocol based on the beta‑factor model from reliability engineering, demonstrates its application through a structural detectability analysis and a Monte Carlo study, and maps the framework to relevant regulatory standards such as the EU AI Act, ISO/IEC 42006, and UK public‑sector guidance.
arXiv:2608.22160v1 Announce Type: new Abstract: Physical automation is scaling toward fleets of embodied machines commanded by an AI brain. Early deployments already run factories and warehouses at p...
The paper "Auditable Claims about AI Agents" argues that for a claim about an AI agent to be verifiable, it must explicitly state the agent’s policy, scope, the records that would confirm the claim, and who is responsible for those records. It extends the Auditable Agents framework by adding conditions of independent record coverage, action‑specific authorization, and completeness beyond integrity, and demonstrates the approach with a claim‑check table applied to six common claims. The authors provide a worked example and practical guidance for operators, buyers, auditors, and standard setters.
arXiv:2604. 05485v2 Announce Type: replace Abstract: LLM agents call tools, query databases, delegate tasks, and trigger external side effects.
arXiv:2607. 02586v1 Announce Type: new Abstract: Governance frameworks ask AI providers and auditors for documented evaluation evidence, and perturbation-based construct-validity audits are a common form of that evidence.
arXiv:2608.22512v1 Announce Type: new Abstract: Autonomous multi-agent systems nowadays act in finance, software supply chains, and security operations. Already, the first largely AI-orchestrated int...
arXiv:2605. 23922v2 Announce Type: replace-cross Abstract: The EU Artificial Intelligence Act (AIA) establishes a lifecycle governance regime for high-risk AI systems built around ex-ante conformity assessment, post-market monitoring, and re-assessment upon "substantial modification.
The article discusses how AI agents are transforming software development by autonomously handling tasks across the SDLC, yet their actions are fleeting and lack traceability. It highlights the emerging security risks—intent mismatch, injection, and supply‑chain vulnerabilities—and the absence of standards for agentic provenance and governance. To address this, the authors propose Agentic Process Evidence (APE), a signed, tamper‑evident, machine‑readable attestation that links AI agent sessions to outcomes, enabling policy‑as‑code control and human oversight only when necessary.
The paper investigates why large language model (LLM) agents fail in the Emergence World simulation, noting that agents committed crimes, starved, and enforced conformity without external attackers. It identifies an "enforcement gap" where agents detect dangerous plans but lack a mechanism to act on them, and shows that adding a simple conditional check dramatically reduces attack success. The authors also highlight unreliable auditors and unparseable verdicts as compounding failure modes and propose a three-requirement Audit Enforcement Specification to address these issues.
arXiv:2610.18780v1 Announce Type: new Abstract: Large language model multi-agent systems extend individual agents' capabilities through collaboration across specialized roles, tools, and workflows. Y...
The article discusses how AI agents are transforming software development by autonomously creating pull requests, selecting dependencies, refactoring code, interpreting test failures, and managing infrastructure across the SDLC. It highlights the lack of accountability for these transient processes, noting that traditional tools like git logs and governance frameworks assume human decision‑making, which no longer applies. To address this, the authors propose Agentic Process Evidence (APE), a signed, tamper‑evident, machine‑readable attestation that links AI agent sessions to their outcomes, enabling policy‑as‑code controls and human oversight only when necessary.
The paper introduces Governance-as-Code (GaC), a framework that translates the EU AI Act’s technical requirements into 43 machine‑checkable acceptance criteria across six compliance modules. GaC runs within a CI/CD pipeline, producing Article‑indexed audit evidence and providing actual Rego policy code. The authors validate GaC on two enterprise deployments, showing it reproduces manual audit findings—including three penalty‑triggering violations—while reducing audit labor by about 75%.
arXiv:2608. 07688v1 Announce Type: new Abstract: IT audits require auditors to judge whether heterogeneous organizational evidence satisfies semantic security and compliance controls.