Audit-evidence checklist
What a reviewer actually asks for, and the artifact that satisfies each ask.
Why it exists
Teams prepare for audits by writing policy. Reviewers ask for evidence. The gap between those two is where examinations go badly.
What it contains
The reconstruction test — can you show what a specific agent did on a specific date and why it was permitted
Authority evidence — the grant, its scope, and the human who issued it
Policy evidence — which policy version evaluated the action, and its decision record
Change evidence — model and prompt versions in effect at the time of the action
Oversight evidence — what a human reviewer saw, and how long they had to see it
Retention mapping — how long each class of evidence must survive, per regime
Status
The full reference document is being prepared for publication. If you want it as soon as it is out — or want to review a draft and push back on it — say so and I will send it.
Want this applied to your architecture?
The artifacts are general by design. Applying one to a specific estate is what the governance review does.