Your AI agents are taking financial actions. Can your compliance program prove they were authorised to?

ASIC and APRA jointly require dependency maps and clear accountability between entities and their AI financial providers. Your current compliance program documents AI governance policies. It does not produce independently reconstructable evidence for each specific agent.

Your cyber insurance renewal questionnaire will ask nine specific questions about your autonomous agents, credentials, consequential actions, approval boundaries, revocation, and action reconstruction. Your current documentation cannot answer all nine from a single independent source.

AIUC-1 made authority reconstruction a mandatory control in Q2 2026. The standard requires substantive, verifiable, independently reconstructable evidence. Self-reported records and platform-generated logs do not satisfy the independence requirement.

Your board and audit committee are asking about AI agent risk. You can explain the governance framework. You cannot yet show them a specific authority record for a specific agent that demonstrates the framework is actually working.

When something goes wrong: a payment approved outside declared limits, a credit decision made without the required oversight, the compliance question is not whether the agent had technical permission. It is whether it had organisational authority. Those are different questions and only one of them has been answered.

An independently reconstructable Authority Record for each financial agent, produced by a third party outside every system being assessed, satisfying the independence requirement that self-reported compliance cannot meet.

An Authority Exposure statement: specific, quantified gaps between declared policy and technical reality, in language legible to a board or audit committee.

AIUC-1 compliance evidence: the independently reconstructable records the standard requires, produced in the format that satisfies the mandatory control.

ASIC and APRA dependency maps: the specific documentation the joint guidance requires, produced independently for each financial agent.

A Proof Room: controlled external evidence shareable with regulators, insurers, and audit committees without exposing internal architecture.

Authority Watch: continuous monitoring that satisfies the ASIC and APRA requirement for ongoing accountability rather than point-in-time assessment.