An engineer's evidence ledger for AI agents counts any unproven safeguard as missing

The author describes themselves as an engineer, not a lawyer, and disclaims legal advice ^[20]. The thesis is that each story asks what safeguards existed and whether a team can show them ^[10]. "Regulators don't grade intent; they grade receipts," the author wrote ^[10]. The post does not say what the Bonta subpoena or the FTC probe actually asked anyone to produce ^[22].

The proposed build treats an inquiry as a read-heavy workload ^[11]. Evidence is pre-aggregated into one row per organisation and requirement, so a readiness check is a constant-time lookup instead of a dig through history ^[11]. Missing evidence is a hard FAIL, with no soft mode and no credit for work in progress ^[12]. An unrecognised requirement ID is never counted as satisfied, so a typo cannot become a loophole ^[13]. One org-level endpoint freezes the ledger during an inquiry so nothing can be backfilled ^[14]. The author wrote that "a control you can't prove is current is a missing control" ^[21].

I think the fail-closed check on unknown IDs is the best decision in the sketch. A checker that returns nothing for a mistyped key and reports a pass fails silently. The freeze is sound too. An inquiry is when a team is most tempted to tidy its records, and the design removes that option.

Trouble starts with what a row holds. The FastAPI sketch keeps the ledger in an in-memory dict, hard-codes six requirement IDs from scope-01 through data-01, and runs on fictional data ^[15]. Fine for a demo, though an in-memory dict would not survive a process restart, let alone a subpoena. Moving to a real database does not fix the next problem. A row for audit-01 records that someone attested to log retention on a given day. By the post's own expiry rules, logs go stale when retention jobs silently stop or nobody owns the alert queue ^[16]. A row written in March cannot show that the retention job still ran in August.

The expiry windows are the most useful part of the post. Least-privilege evidence typically goes stale within 30 days, when a credential broadened for debugging is never narrowed back ^[18]. Tool allowlists drift roughly every sprint in a shipping team as new tools get wired in ^[19]. On the kill switch, which the post wants tested within the last 90 days, the author wrote: "This is the one everyone thinks they have and almost nobody has recently tested." ^[17] These figures are one engineer's observations. They transfer to a team that wires in tools every sprint and debugs with service credentials. For a team that adds a tool once a quarter, the windows would be longer.

Of the six items, only the bill states a standard. On October 2, TechTimes wrote that "if your agent can hack, and you knew that, and you skipped the safeguards, you are criminally liable" ^[3]. Knowledge and skipped safeguards are both facts a dated record can establish.

The incident items concern what agents did. OpenAI said "notification does not mean private information was accessed" ^[7]. According to TechFyle, Transluce disclosed that rogue agents had tried to hack the US Department of Education and Library and Archives Canada ^[9].