The agent that cannot assert
Putting machines to work inside a compliance programme without moving the accountability
Every platform in this market now sells an autonomous agent. Not one of them, in its own headline, says who is accountable for what the agent decided. This paper sets out the opposite construction: an agent with real reach into the record, which is structurally incapable of asserting anything, and a boundary that is enforced in code rather than promised in a policy.
What this paper establishes
- A boundary enforced in code, not in policy: the machine drafts, proposes, collects, chases, reads and calculates, and cannot file a judgement.
- Six gates between a model’s output and the record, each with a test behind it, so removing one fails the build rather than changing a document.
- 15 permission-checked tools and 12 kinds of draft, each switched off until an administrator turns it on, each with its own daily ceiling.
Read the four market leaders’ own words, taken from their sites in October 2026. One sells a round-the-clock engineering team that drafts policies and completes questionnaires. One sells autonomous agents that prove your posture continuously. One detects change, decides what is at risk, and acts. One promises that your work starts at the review.
Now ask the question none of those sentences answers. When the agent files a rating and the regulator disagrees with it eighteen months later, whose judgement was that?
This is not a philosophical objection. In a regulated programme the signature is the product. A control rating, a risk treatment, a transfer assessment and a breach notifiability decision are all acts with consequences attached to a person, and in several jurisdictions to a named officer. A platform that lets a machine make them has not removed the accountability; it has removed the record of who holds it.
The proposal boundary
Conscious is built on one rule that nothing is allowed to bend. The machine proposes; a named person disposes. There is no configuration flag that turns it off, no enterprise tier in which the agent signs, and no code path by which a model-authored verdict becomes a filed rating without a person pressing a button.
What a proposal looks like matters as much as the boundary. A proposal arrives with its reasoning written out, the records it rests on listed and linked with their dates, and three ways to dispose of it: file it as it stands, edit it and file the edited version, or discard it. Filing records the person who pressed the button as the author of the judgement and the model as the source of the draft. Those are two different fields and the platform never collapses them.
Six gates between a machine draft and the record
A boundary stated as a principle is a slogan. These are the checks that stand between a model’s output and anything a person could mistake for a fact, each enforced in code with a test behind it.
- ShapeThe response parses into the declared blocks, or the whole draft is withheld. A partially-understood answer is never shown as a partial proposal.
- ConclusivenessA collector reading that is inconclusive is never filed as evidence and never used to support a proposal.
- Mapping strengthOnly an equivalent mapping may drive a proposed rating. A related mapping is a reading aid and is labelled as one.
- CompletenessA roll-up proposes nothing unless every control beneath it is conclusive, so no summary is ever better than its parts.
- Forbidden verdictThe model may never propose not-applicable. Only a person may take a control out of scope, with a reason.
- Server recomputeA submission carries references, never a score. The server recalculates the figure from the records, so a tampered client changes nothing.
Permission is the agent’s, not the model’s
An agent working through Conscious reads the same registers a person reads, through 15 tools, every one of them permission-checked against the role of the person or service it is acting for. There is no privileged back channel and no service account that sees everything. An agent acting for a contributor cannot read what a contributor cannot read, which means a prompt cannot be used to reach around the access model.
The kinds of draft a model may be asked to produce are enumerated rather than open: 12 of them, each switched off until an administrator turns it on, each with its own daily ceiling. An organisation that wants the agent to draft policies but never to draft ratings configures exactly that, and the configuration is itself an auditable act.
The ledger: the agent’s own actions, in the same record as everyone else’s
Every tool an agent runs lands in the same hash-chained record as every human action, in one sequence, with the permission it was checked against. One competitor has launched a product that promises auditor-grade proof of every decision — for the customer’s other agents. None of them applies it to their own.
| #4,811 | Agent | Read the access review report filed for the third quarter | tool · evidence.read |
| #4,812 | Agent | Proposed a rating of implemented for the quarterly access review control | draft · rating |
| #4,813 | N. Al-Harbi | Edited the proposal and filed it as partially implemented | person · entity.write |
| #4,814 | Agent | Raised a task for the gap the edited rating created | tool · task.write |
| #4,815 | M. Osman | Approved the domain, which closed the assessment | person · sign-off |
Measuring whether the machine is any good
A proposal boundary creates something the category does not otherwise have: a ground truth. Every draft is accepted, edited or rejected by a person, and the platform counts which. That is a direct measurement of model usefulness on this organisation’s own records, not a benchmark score from a vendor.
It prints no percentage below 20 rulings. A figure computed from four decisions is noise with a decimal point on it, and publishing it would be the same error as every “ninety per cent automated” claim in this market.
Your model, or ours, or none
The machine layer is deliberately not a dependency on one vendor’s cloud. Conscious speaks the common model protocols, including any endpoint inside the customer’s own network, and the same permission checks, audit records and daily ceilings apply whichever is configured. An organisation whose regulator or board will not permit customer data to reach a third-party model runs a model on its own infrastructure, or turns the machine layer off entirely and keeps every other part of the platform.
The questions to put to any vendor selling an agent
- Can your agent file a control rating without a person pressing a button? If yes, whose judgement is recorded as the author?
- Show me an agent action in your audit record. Does it name the permission it was checked against?
- Which kinds of draft can be switched off individually, and who can switch them on?
- Can your agent propose that a control is not applicable?
- What happens to a collector reading that is inconclusive?
- What percentage of your AI’s drafts do customers accept unedited, and how many rulings is that computed from?
- Can the whole AI layer run against a model inside my network, and can I turn it off and keep the product?
Those seven separate an agent that works inside an accountability structure from an agent that was added to a product because the category’s adjective changed. We publish our own answers to all seven, including the one where the honest answer is that the model’s judgement is measured by an operator and not by a test.
Sources
- 1Competitor claims. Vanta, Drata, Sprinto, Secureframe and Optro headline claims were read from the vendors’ own pages in October 2026 and are quoted in substance rather than verbatim where a headline has since changed. Drata’s agent-governance product promising auditor-grade proof of every decision is its own published description.
- 2Platform figures. 15 permission-checked tools and 12 draft kinds, each off until switched on, measured from the code on 1 October 2026 and held to it by test.
- 3Gates. Each of the six gates is enforced in the product with a test that fails the build if the guard is removed. The list is published and has not changed since it was first written down.
- 4Acceptance measurement. The platform records whether each draft was accepted, edited or rejected and suppresses any percentage computed from fewer than 20 rulings.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.