2 min lesson
Controls auditors trust even when agents do the work
Work through this: "An auditor asks how a specific booked revenue figure came to be. What property must your automated stack have to answer cleanly and how does it stay true when an agent is involved?"
Step 1 of 2
Controls auditors trust even when agents do the workthe new question for an AI-forward stack
- Log the automation's inputs, proposal and the human approval as first-class evidence - an agent action is a change like any other.
- Keep the human approval gate on anything that posts or moves money, so accountability always lands on a person.
- Wrap agents in deterministic, testable checks an auditor can inspect, rather than asking them to trust a model's judgment.
- Be ready to re-perform: given the same inputs, the controlled pipeline produces the same numbers.
Name the central tension out loud: control rigor versus the speed Cursor expects. Then resolve it instead of just stating it. The resolution is that your controls are mostly automated and ride the same PR/CI pipeline that gives you velocity, so adding a control doesn't add a meeting. That's the answer that proves you can be fast and audit-ready at once, which is the whole reason this role is hard to fill.
“Take any booked dollar and walk it back: it points to a journal entry, the entry to a rev-rec schedule, the schedule to a contract and the metered usage event that carries an immutable id. The ledger is append-only, so a correction is a reversing entry plus a new one beside the original, never an edit that hides it. When an agent did part of the work the trace doesn't change - its inputs, its proposal and the human approval are logged as change evidence right alongside the entry, so I can re-run the same inputs through the pipeline and land on the same number. The agent isn't a gap in the trail; it's one more logged, re-performable step in it.”