Let an agent plan and collect, but never let it decide. Tool scoping, human gates, and provenance for machine-gathered evidence.
55 min 225 XPSkills: Agents, Evidence, Human oversight
Brief
An agent that can call tools is very good at the tedious half of evidence work: finding the right endpoint, paginating, reshaping output, drafting a summary. It is very bad at the half that carries liability: deciding whether what it found satisfies a control.
The design rule follows directly. Agents plan and collect; humans decide. Everything else in this room is machinery for enforcing that line.
Let the agent do the fetching. Never let the agent do the concluding.
The loop, and the arrow that must not exist
A workable loop is plan → collect → present → human gate → record. The agent proposes what to gather and why, executes read-only tools, and hands a structured package to a reviewer. The reviewer's decision, not the agent's summary, is what gets recorded as evidence.
The dangerous arrow is the one that skips the gate: an agent whose output is written straight into the evidence store. Once that exists, a confident hallucination becomes an audit artefact.
The dashed arrow is the whole risk. Design so it cannot be drawn.
Scope the tools, not the prompt
Prompt instructions are guidance; tool permissions are control. An agent asked politely not to modify anything, holding a credential that can modify things, is one confused turn away from doing so. Give it read-only scopes, per-tool allow-lists and a separate identity from any human.
That identity matters twice: it bounds the blast radius, and it makes machine-gathered evidence attributable in the run record.
Draw this line explicitly, or it will be drawn by whoever is in a hurry.
Provenance for machine-gathered evidence
Machine-gathered evidence needs everything human-gathered evidence needs plus three fields: the model and version, the tool calls made with their parameters, and the reviewer who approved the result. Without them you cannot answer 'how was this produced?' a year later.
Treat an unreviewed agent output as a draft, and store it as such. Drafts and evidence living in the same place is how a summary becomes a fact.
Grounding beats fluency: an answer with a citation you can resolve is worth ten that read well.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The agent that closed its own finding
Scenario sim+75 XP
Name the missing step, then what the agent's output should have been stored as.
Incident brief
An evidence agent collects IdP data nightly, writes a summary paragraph, and files it directly into the evidence store tagged with the control id.
In August it summarises 'all administrative accounts have MFA enrolled'. Fourteen service accounts with admin roles were excluded by its own query filter, which it also wrote.
The summary is quoted verbatim in the quarterly pack and later in the audit response.
Term bank, not all of these are right
human gatedraftevidencereviewsamplingescalation
1.1Name the missing step. (two words)
1.2Name what the output should have been stored as. (one word)
Task 2: Asked nicely not to write
Scenario sim+75 XP
Name the control that was missing, then the identity the agent should hold.
Incident brief
The agent's system prompt says: 'You must never modify any resource. Only read.' It runs with an engineer's cloud credentials because provisioning a service principal takes two weeks.
During a retry loop it calls a tool whose name suggests a read but whose implementation issues a tag update, disabling a monitored resource for six hours.
The postmortem recommends strengthening the prompt wording.
2.2Name the identity the agent should hold. (two words)
Task 3: Cited, plausible, absent
Scenario sim+75 XP
Name what the workflow must record, then the check that would have caught this.
Incident brief
An agent drafts a gap analysis citing six control ids from the company standards repository. Five resolve. The sixth, cited twice and quoted with a section number, does not exist in any revision.
The reviewer approves the document in nine minutes and no record is kept of which model produced it or which tools it called.
The finding is escalated to the risk committee two months later.
The evidence agent currently runs nightly with an engineer's cloud credentials, is told in its system prompt never to modify anything, and writes its summaries straight into the evidence store.
Rewrite the workflow definition so the agent can plan and collect but never conclude: read-only scoped tools, its own identity, a human gate before anything is recorded, output stored as a draft, and provenance an auditor can read.
Incidents and available platform primitives
incidents:
a "read" tool issued a tag update during a retry loop and disabled a monitor
an August summary asserted full MFA coverage; its own filter excluded 14 admin service accounts
a gap analysis cited a control id that exists in no revision of the standards repo
platform provides:
service principals with per-tool allow-lists and read-only scopes
a review queue with named approvers
a drafts area separate from the evidence store
standards-repo revisions addressable by id
An evidence agent has been running for a month and the team wants to expand it to three more control families. The run configuration and last week's output are up for review.
Accept the parts that keep the agent on the collecting side of the line. Reject anything that lets it conclude, write or publish without a human.
Verdicts are accept or reject. Every rejection needs one reason code from: unscoped-tools | no-human-gate | unverified-citation | draft-stored-as-evidence.
Agent run configuration and output: entries under review
L-1 The agent proposes a collection plan; a named reviewer approves it before any tool runs, and all tools are read-only.
L-2 The agent executes with an engineer's cloud credentials; the system prompt instructs it never to modify anything.
L-3 Every control id the agent cites is resolved against the named standards-repo revision before the draft reaches a reviewer.
L-4 The nightly summary is written straight into the evidence store, tagged with the control id.
L-5 Last week's gap analysis cites a control id and section number that exist in no revision of the repository.
L-6 Unreviewed agent drafts are filed in the same folder as approved evidence, distinguishable only by filename.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · AI & Advanced
AI Risk Management with NIST AI RMF
Govern, Map, Measure, Manage turned into an operable control set with owners, evidence and metrics rather than a maturity poster.
