AI outputs are advisory until someone signs

Summary: A government AI programme is going well until internal audit asks who signs when the agent is wrong. Nobody can answer. This is the story of how that question gets answered, and why the answer turns governance from a brake into the reason agents can finally ship.

The steering committee had been going well for forty minutes. Three agents demonstrated. An HR onboarding assistant, a procurement query bot, a finance reconciliation agent that had, live on screen, caught a duplicate invoice. The director of digital transformation who’d sponsored the programme was, understandably, pleased with herself.

Then the head of internal audit, who hadn’t said a word, asked one question.

“When one of these is wrong, who signed?”

Nobody had an answer. Not the vendor. Not the platform team. Not the sponsor. That silence is the most useful thing that happens in most AI programmes, and it usually happens far too late.

The two wrong answers

Faced with that question, programmes reach for one of two escapes.

The first is the disclaimer. Put “AI-generated, please verify” under every output and carry on. It satisfies nobody who has ever been audited, because a disclaimer shifts blame to the user without giving them any way to act on it.

The second is the lockdown. Strip the agents of anything that could cause harm until they’re glorified search boxes. Safe, and pointless. Gartner’s June 2025 forecast that over 40% of agentic AI projects will be cancelled by 2027 names “inadequate risk controls” as a cause. It also names “unclear business value”. The lockdown fixes the first by guaranteeing the second.

Both are ways of not answering the question.

The reframe

We’d been through this before, on a programme for a federal government entity in the UAE, and the sentence that unlocked it was short.

An AI output is advisory until a named person signs it.

Not a disclaimer. A workflow. Every answer, draft, report and dashboard narrative the platform produces carries three things: a visible AI-generated marker, a confidence indicator, and the list of sources it drew on. It’s advisory by default. If the entity decides a specific low-risk task can run on its own, that decision is itself recorded, with the approver, the time, and the evidence they relied on.

Once you say it that way, the audit question stops being unanswerable and becomes a design brief. Who signed? The person in the approval record. What did they see? The sources and the confidence score. Can we prove it? Yes, and here’s how.

Building it before scaling, not after

The threshold moment in that programme was the decision to build the governance layer first, while there were three agents, rather than retrofit it at thirty. That’s the opposite of the usual instinct, which is to prove value fast and tidy up later. Later never comes, because by then the agents are load-bearing and nobody wants to touch them.

What the layer actually consists of is less exotic than the word “governance” suggests.

An approval inbox. High-impact actions never execute directly. Payments, hiring decisions, contract awards, anything that leaves the building as an external communication, legal steps, system changes. Each is staged, and a person with the authority releases it. The agent does the work; the human owns the consequence.

A ledger that can’t be edited. Every prompt, every retrieval, every tool call and every approval is recorded append-only and hash-chained, so a record can’t be altered after the fact without the chain showing it. This is what an auditor reads. It’s also, quietly, what protects the platform team when something goes wrong and the first instinct is to blame the machine.

A registry. One place that lists every agent, model and prompt with an owner, a risk class, a lifecycle state and a version history. If you can’t name the owner of an agent, you don’t have an agent, you have a liability.

Gates that say no. Bias and hallucination tests run before promotion, and a failing score blocks it automatically. No steering committee, no exception process. The build simply doesn’t ship.

And limits on what an agent may do at all. Each one gets a dry-run before real execution, idempotent actions so a retry can’t double-pay, and an explicit list of tools it’s allowed to call. That last one matters more than it sounds. OWASP’s 2025 Top 10 for LLM applications lists “excessive agency” as its own category, at number six, and prompt injection at number one. Agency limits address both at once.

What the layer records, and why

The first objection

The real test isn’t the auditor. It’s the first time an ordinary user hits a wrong answer.

In most systems, that moment vanishes. The user shrugs, works around it, and tells a colleague at lunch. The error is never recorded, so it’s never fixed, and the platform’s reputation erodes one lunch at a time.

The design we use lets any user correct or object to a specific output from inside the interface. The item is flagged, routed to the responsible content or data owner, and its disposition is written to both the ledger and the improvement backlog. A user can also skip the AI entirely and escalate to a human owner. That escape hatch is part of what makes people willing to use the thing at all.

The first objection on that programme came from a procurement officer who spotted a misread contract clause. Within a day the source document was corrected, the retrieval re-indexed, and the ledger showed exactly who’d done what. That’s the ordeal passed. Not a flawless agent, but a system that visibly gets better when it’s wrong.

The return

Two things happened after that, and the order matters.

First, internal audit read the ledger and signed off. Not because the agents were perfect, but because every action had a name, a time and evidence behind it. That’s what audit actually wants. They aren’t asking for zero errors. They’re asking for accountability.

Second, and this is the part nobody expected: the entity approved its first fully autonomous task. A low-risk, high-volume process that had run advisory for months with a clean record was released to execute without a human in the loop. Governance hadn’t slowed the programme down. It had built the trust that let it speed up.

None of this is invented. The controls map to ISO/IEC 42001, the AI management system standard published in December 2023, and to the four functions of the NIST AI Risk Management Framework from January 2023: govern, map, measure, manage. The frameworks exist. What’s usually missing is somebody deciding to build to them before the audit question gets asked.

If you’re the person who’ll be sitting in that steering committee when the question comes, talk to 10ⁿ Tech before it does.

Related resources

• Why enterprise AI agents stall between pilot and production
• Sovereign AI in the GCC: what in-country actually requires
• Self-hosted enterprise AI

Photo credits: Karthik B K and Scott Graham on Unsplash.