The rise of agentic development tools, which delegate code change preparation to AI agents, raises the question of workflow auditability. In regulated sectors, knowing who approved a change is no longer enough: it must be possible to reconstruct the context, controls, and decisions that produced it.
Within a large financial institution using an agent in its development workflow, the internal audit and compliance team asked a specific question. For a merge request opened by an agent to update a dependency of a payment service, could they indicate who approved it, what input data and prompts the agent used, what policy controls were evaluated, and how to reproduce or undo this task? The team had no answer. The delivery system did not consider the agent’s work as a bounded, auditable transaction.
A diff validated by CI (continuous integration, which automatically tests code) and approved proves that a change occurred. However, it does not prove the context used by the agent, the policy decisions evaluated before creating the merge request, nor the ability to reproduce the result on a subsequent run. Yet, in regulated environments, the “how” and “why” are essential. This situation is found across platforms and in DevSecOps organizations: the budget for agentic tools is approved in weeks, while that for execution records, identity binding, and replay tools never appears or is treated as a mere compliance cost.
Four Recurring Exceptions
As soon as agents open merge requests in a regulated CI/CD environment, four types of compliance exceptions appear. The first is missing provenance: no one can say what data the agent used, whether specifications, retrieved context, tool calls, or repository state. The second is uncertain identity attribution, since the agent acted under a shared service token, without a designated human owner. The third is an unreconstructable decision chain, the reasoning having been captured only ephemerally. The fourth is unbounded rollback: the agent’s changes being coupled, any reversal becomes manual work across commits and repositories.
Post-hoc reconstruction involves examining conversation logs, partial CI outputs, and any remaining agent traces. In most organizations, no one accounts for the hours spent weekly on this task, which is why its cost remains invisible. The source proposes a simple test: is a team able to produce, in less than an hour, an evidence dossier bringing together the task specifications, repository state, evaluated controls, and the human owner responsible for the action?
“Deliver First” and Its Limits
The “Deliver first, govern later” strategy can work when agents are confined to limited scopes, such as test generation, small refactorings, or documentation updates, with robust human review. It fractures, however, when teams bypass it, prompt libraries multiply with inconsistent logging, and shared tokens make attribution impossible at the portfolio scale. The article also cites the case of a large company that wanted to build a workflow foundation before scaling agents: the platform project stretched over several quarters, and teams ended up circumventing it.
The article notes that “competitive pressure rewards speed, while regulators reward the ability to reconstruct.” It describes the cost of this gap: missing evidence discovered during an audit, weeks of remediation, and a radius of impact that widens with each poorly recorded agent action. It cites Crédit Agricole CIB in this regard, which is piloting, according to the text, a delivery platform bringing together thousands of developers spread across dozens of countries on a single DevSecOps platform, a prerequisite for auditing agentic work.
Naming and Measuring the Work
The source recommends treating this effort as a full-fledged product, named “Recorded Execution for Agentic CI/CD, ” with resources bringing together platform engineering, security, audit, and developer experience. Its deliverables cover a recording schema capturing input data, outputs, tool calls, and model version; identity binding linking each action to a human owner; policy decision logs; as well as replay and rollback mechanisms. Tracking can rely on the depth of the exception queue, the median time to obtain evidence, the replay success rate, and the exception reopening rate.
If only one step must be taken, the text advises starting with the highest-risk cases, such as dependency changes, Infrastructure as Code modifications, and security configuration. The final proposed test is to ask a team to cleanly undo a merged change written by an agent, relying solely on recorded artifacts.
