There are two kinds of enterprise AI teams: those who treat compliance as a launch blocker, and those who treat it as an architecture. The first kind ships demos and stalls at legal. The second kind ships to defence, healthcare and BFSI — because they stopped trying to bolt evidence onto a system and started generating evidence as the system's exhaust.
What regulators actually ask
Strip away the sector specifics and audit questions converge on four demands. Provenance: who — or what — produced this decision, from which inputs? Authority: who approved it, and were they entitled to? Boundary: what data could the system see, and was that lawful? Recourse: when it went wrong, who owned it and what happened next? A system that can answer those four questions from live records passes audits as an export job. A system that can't answers them with archaeology — weeks of log spelunking and reconstructed timelines.
Gates: authority made structural
A gate is a review surface where a named human sees exactly what is about to happen — the artifact, its version, its rationale — and signs. Two structural rules do most of the compliance work: no approval without inspection (the system warns if the approver never opened the diff), and no self-approval (authors cannot sign their own work, humans and agents alike). Gate authority is stricter than visibility — seeing a screen never implies the right to sign it.
Trails: evidence as exhaust
Every fact in the graph carries lineage to its source record. Every decision carries the policy version it ran under and the confidence its agent assigned. Every waiver of a check is recorded with a reason, an owner and an expiry. None of this is written for the auditor — it is how the system runs — which is exactly why the auditor can trust it.
Named owners: recourse by design
Anonymous queues are where accountability goes to die. In a governed pipeline, every exception routes to one named person with an SLA and full context. That single design choice answers the recourse question before it is asked — and, in our experience, it is also what wins over the internal skeptics: nothing builds trust in automation like knowing precisely who gets the case when automation declines it.
The counterintuitive payoff
Teams expect governance to cost speed. Delivered as architecture, it buys speed: decisions in seconds because the policy is encoded; audits in hours because the evidence is generated; approvals concentrated where judgment matters because gates sit on consequence, not on volume. Our regulated-sector work — HIPAA healthcare, on-prem defence, BFSI audit regimes — runs on exactly this stack. Compliance stopped being the reason AI can't ship, and became the reason it could.