You are being asked to audit AI agents. The evidence your clients are producing is self-reported. That is not sufficient.

Your client can show you logs from Salesforce, Okta, and their IAM system. Every one of those records was produced by a system with a direct stake in the outcome. They are self-reported. They are not independent evidence.

Your client's governance platform produces compliance dashboards. The governance platform is itself part of the infrastructure being assessed. Its dashboards reflect what it observed from inside its own systems. That is not an independent audit.

AIUC-1 requires independently reconstructable evidence for agent identity and authority reconstruction. Independently reconstructable means produced by a party outside the systems being assessed. Your client's internal records do not satisfy this requirement.

The authority chain for a financial agent spans multiple systems, the identity provider, the agent runtime, the application layer, the financial systems, the approval workflow. No single system sees all of it. No internal team can reconcile it independently.

When you ask whether a specific financial transaction was within the agent's authorised limits, your client can tell you what the policy says and what the logs show. They cannot produce an independent reconciliation of the four authority layers (declared, delegated, technical, and exercised) across every connected system.

An independently reconstructable Authority Record produced by a party outside every system being assessed, satisfying the independence requirement that internal records cannot meet.

Evidence quality labels on every finding: Verified, Corroborated, Client-reported, or Unverified, so you can assess the strength of every claim rather than accepting the client's account of their own controls.

Action Replays for specific financial transactions: independently reconstructing whether each one was within declared and delegated authority, with evidence quality labelled for every step.

The Authority Gap Test: a quantified comparison of declared versus technical authority that gives you a specific, measurable finding rather than a qualitative assessment.

A Proof Room: a controlled external view of the Authority Record that can be included in your audit deliverable as independently verified third-party evidence.