The procurement documents are the leading indicator
If you want to know where enterprise AI is actually going, do not read the keynotes. Read the solicitations. In the past two quarters, formal procurement documents from major regulated institutions — the kind reviewed by risk committees before publication — have started asking, in writing, for agentic automation of controls testing, for AI-generated variance explanations suitable for executive reporting, and for continuous monitoring that detects a control drifting before an auditor does.
Read those asks carefully and a pattern appears. No one is asking for an autonomous system they cannot see into. Every ask couples the automation to an evidence requirement: workpapers generated with lineage, narratives that cite their numbers, monitoring with an audit trail of what was checked and when. The market is not asking “can the agent act?” It is asking “can the agent show its work to someone whose signature carries liability?”
The board’s actual question
A board does not evaluate model architectures. A board evaluates exposure. When an executive proposes letting software agents draft journal-entry testing, dispatch work orders, or reallocate staff, the board’s question is ancient and entirely correct: when this goes wrong, will we be able to show we were in control?
“In control” has a specific meaning in that room. It means the organisation can demonstrate, after the fact and under adversarial questioning, that every consequential action had an authorised owner, a documented basis, and a bounded blast radius. Traditional automation passed this test with change management and access controls. Agentic systems break the old test — the “change” is now a decision made at runtime — so the control has to move to where the decision happens.
Evidence-bound autonomy, stated plainly
The architecture we advocate — and build — inverts the usual order of operations. The agent does not act and then log. The agent produces its evidence first: the signals it read, the policy clauses it consulted, the reasoning chain it followed, the action it proposes, the systems that action will touch, and the reversibility guarantee it can offer. That packet is sealed into a hash-linked ledger, and only then does one of two things happen: the action executes inside a policy boundary an operator previously authorised, or it waits at a human gate because it is consequential enough to warrant one.
Under this model, the distinction between “automated” and “manual” stops being a risk category. Both produce the same artefact: a decision with its evidence attached, attributable to a policy and a person. The auditor reviews decisions, not systems. The board attests to a control, not a hope.
The narrative layer is not decoration
The most underestimated requirement in current enterprise asks is the narrative one: variance explanations, decision rationales, and board-facing summaries generated by the system itself. It is tempting to dismiss this as report-writing automation. It is closer to the opposite: the narrative layer is where trust either compounds or collapses.
A generated narrative that cites its own evidence — every number linked to its source, every claim to its signal — teaches executives to trust the system a little more each quarter, because every spot-check lands. A generated narrative that hallucinates one number, once, undoes a year of that. The engineering consequence is strict: narrative generation must be grounded in the same evidence ledger as the decisions it describes, with citation as a structural requirement rather than a stylistic habit. If the system cannot cite it, the system does not say it.
Five commitments to require of any agentic system
Evidence before action. No consequential action without a sealed evidence packet — not after, before. Policy as the boundary of autonomy. What the agent may do alone is written policy an operator can read and change, not an emergent property. Human gates where the consequence lives. Escalation to a person is a designed path with the evidence attached, not an exception handler. A ledger that survives hostility.Tamper-evident, replayable, and independent of any single person’s account of events. Narratives that cite. Every generated explanation traceable to the ledger it summarises.
None of these five slow a well-built system down. They are, in our experience, the precondition for being allowed to speed up — because the institutions with the most valuable operations to automate are precisely the ones that will not, and should not, accept autonomy without evidence.