AI agents that survive compliance review

The demo went well. The agent summarized the case file, drafted the response, and cited the right policy. Then came the meeting with security and compliance. What data did it touch? Can it act on its own? How do you know it was right? Who is accountable when it is wrong? The pilot never left that room.

This is the most common failure mode in enterprise AI, and it has nothing to do with model quality. The system was built to impress the demo audience. The review audience grades on different things.

Design for the reviewer

Teams that get AI into production treat the compliance review as a design brief. The reviewer's questions map to system properties. Scoped permissions answer 'what can it touch'. A clear list of allowed actions answers 'what can it do'. Evaluation harnesses answer 'how do you know it works'. An audit log answers 'show me what happened'.

Agents should run under least privilege like any other actor in the system. Read access to exactly the data the task requires. Write access to nothing by default. Credentials that expire with the session. 'The agent can see everything the user can' is not a permission model. It is an incident report waiting for a date.

Make behavior inspectable

Every production agent we ship keeps a structured record of each run: inputs, retrieved context, tool calls, outputs, and the policy checks that fired. This is not debug logging. It is the evidence that lets a compliance officer reconstruct any decision six months later. If your agent cannot explain a specific past action, it is not ready for a regulated environment.

Evaluation deserves the same rigor. A regression suite of representative tasks, including the hostile and edge cases, runs on every model, prompt, or retrieval change. Stories about accuracy do not survive review. Trend lines do.

Humans stay in charge, by design

Agents earn trust in tiers. Read-only first: the agent retrieves and summarizes, and people decide. Then propose-then-act: the agent drafts the action and a person approves it. Last comes bounded autonomy for narrow, reversible actions with a small blast radius. Everything above that line still requires a person.

Each tier has written criteria for moving up, and one incident moves you back down. This framing changes the compliance conversation. 'Is AI safe' is unanswerable. 'Is this action class safe at this autonomy tier' is a question you can engineer against.

Compliance is not a tax on AI. It is the specification for AI that is allowed to matter. Build for the review and the review becomes routine. Build for the demo and the review becomes a wall.