Review what an AI agent produced, and show an auditor what was decided

A run is one execution of an agent, started for a stated purpose. Devi, a data engineer in the Health organisation, writes the purpose and chooses the dataset the agent will read: a dataset is a named collection of records, here the three transcripts. The dataset is at the access level called Raw, the most restricted level, where nobody may read without permission. So the page warns Devi before the button is pressed: the agent has to be granted access, and the request goes to an approver of the department that owns the data.

The run exists at once, but it has not started. A custodian is a person who may decide who reads a department's data. Until the custodian of Cardiology decides, the run does nothing, and it starts by itself afterwards. The tag sandboxed on each row says that the agent's code runs in the isolated container described above.

Hartley is a data custodian for the Cardiology department. The request names the agent's own runtime account, not Devi, because the agent, not Devi, is what reads the data. It also gives the purpose and says what granting does: it covers that purpose only and ends by itself. Hartley presses Grant access. A grant covers one run, so the next run will ask again.

The agent read the three transcripts and wrote a draft note for each. Every line of a draft is a line of the transcript, with its number, so that a reader can check it. The drafts are for a clinician, and the platform adds a rule of its own: what a run produced cannot be reviewed by the person who started it. Devi sees the drafts and no way to review them.

Imani has no Agents menu item, because that page is for the people who build and run agents. The Agent registry lists every agent in the organisation for anybody signed in, and each name in it is a link to the agent's own page. The row says which department owns the agent, who registered it, the risk level it is held at, and that nothing needs attention.

The agent sorts each line of a transcript under a heading by the words in it, so it can put a line in the wrong place. In the third draft it placed two lines from the start of the visit, the clinician's greeting and a question about the water tablet, under Plan. Imani can see them in the draft above and in the box below it, which holds the same text for editing. The page says that only a fingerprint of the final text is kept, never the text: a fingerprint is a value worked out from the exact contents, which changes if even one character does.

Imani deletes the two lines in the box. The box is scrolled to the end of the third draft, where the heading Plan now holds only the line that belongs there. Once the text differs from the draft, the button for saving changes works and the button for accepting the draft is switched off, because the text is no longer the draft as it was.

The platform keeps the outcome, the person, the date and time, the fingerprint of the draft and the fingerprint of the corrected text. It does not keep the corrected text. It also keeps how many seconds passed between the end of the run and the review, so that an auditor can later tell a reviewer who read from one who clicked through. A draft can be reviewed once, and the form has gone.

The two greetings were filed under Plan because the drafter's rules look for words, and two of the words matched inside other lines: the letters of come back are inside Welcome back, and a question about a prescription matched the word prescribed. The corrected code looks for whole words and never files a question under Plan. The platform seals it as version 3, which is finished and closed for good, and compares it with version 2. Nothing that the platform watches has changed: not the tools, the model, the data it is given or the hosts it calls. So no approval is asked for, and the Deploy button works at once.

Only one version of an agent is active at a time, so the green label moves from version 2 to version 3. Version 2 stays in the list, with its fingerprints, and every earlier run still names the version that actually produced it.

A grant covers one run, so the page warns Devi again that Hartley, who looks after Cardiology, will be asked. Hartley grants it, as before, and the run starts by itself.

The same three transcripts give three new drafts. In the third one, Plan now holds only the line that belongs there, and the two greetings are among the lines that fit no heading, so the count of lines not placed has gone up from three to five. Imani reads the drafts and finds nothing to correct, so the button that accepts the drafts is the one to press.

The record holds the decision, who made it, when, and how soon after the run ended. Judging whether a decision was right stays with the organisation, and the record is what lets an auditor ask whether the drafts were really being read.

Nakamura is the data protection officer, a person who watches how the organisation handles personal data. Nakamura reaches the same page from the registry. The section adds up every review of this agent's output: how many were accepted as they were, how many changed and how many refused, how many different people decided, and the middle length of time they took. It is counted for the agent. It never names a person.

The pack covers the risk level history, each version that ran and who approved it, the runs, how the output was reviewed, and any suspensions or incidents. It records who decided what and when, and how many runs there were. It holds no personal data, so the text of the drafts is not in it. With no dates chosen it covers the last 90 days. Making a pack is itself recorded. The page shows the fingerprint of the pack, so that a copy given to an auditor can later be matched to it. It also says how many records the agent's own chain holds. The chain is the agent's oversight records, each stored with a fingerprint of the one before it, so that a change to an old record shows.

The check reads every record again, works out its fingerprint, and compares it with the one stored when the record was written and with the link to the record before it. A record altered afterwards, a record removed from the middle, or one added without the platform would show. Here nothing does, so the page says so. The same check can be run again at any time, by anybody who may make the pack.