« Phase 15 · Warmup · Track Overview

Staff Notes — Judgment, Review Signal & Seniority

Table of Contents

• 1. Build vs buy
• 2. A decision framework for a new agent
• 3. Review red flags
• 4. Production war stories
• 5. The interview signal
• 6. Mentoring notes

1. Build vs buy

The line: integrate with the bank's governance systems; build the evidence generation.

And the specific trap worth naming in a vendor conversation: a GRC platform will offer to be the model inventory. Take it as the register — where risk and audit look — and keep the gate in the deployment pipeline. A register updated by humans diverges within a quarter; a gate cannot, because nothing reaches production without passing it.

2. A decision framework for a new agent

Ten questions, before it is built. Four of them are usually unanswered:

1. What is the impact if it is wrong? Financial, customer, regulatory. This is the tier.
2. Does it take irreversible actions? If yes, Tier 1 regardless of value.
3. Who is the technical owner and who is the business sponsor? Two named humans, not teams.
4. What is it explicitly NOT for? ← the section validation probes first
5. What data does it touch, at what classification? This drives residency and barriers.
6. Which base model, and what is the exit path? ← usually "we'll figure it out"
7. Can we pin every version, including the retrieval snapshot? ← the long-lead item
8. What does the human reviewer see? For anything above read-only.
9. What is the eval suite, and who owns it?
10. Which controls will emit no artifact? ← the one nobody asks

Question 7 has the longest lead time, because retrieval snapshots need a capability from the search layer that usually does not exist yet. Ask it on day one, not at validation.

3. Review red flags

In a design document

• No join key, or one added "later".
• Evidence described as "we log everything".
• No derived_from — correlation by timestamp.
• "The model" meaning only the weights.
• Prompt changes treated as configuration, not model changes.
• Risk tiering by technique ("it's an LLM so it's high risk").
• A tier that changes nothing operational.
• Validation performed by the building team.
• No named business sponsor.
• No stated limitations.
• An eval report with a percentage and no failures.
• Residency asserted from Terraform.
• No region or classification on processing records.
• Reproducibility claimed without a retrieval snapshot.
• Bit-reproducibility claimed for a sampled model.
• An exit plan with no test date.
• Concentration measured per model rather than per provider.
• Provider retention and abuse-monitoring terms unstated.
• A hand-written control-coverage matrix.
• No silent controls named.
• An evidence pack that "will be assembled if needed".
• Retention that does not distinguish evidence from traces.

In code

# Red flag: an optional join key
trace_id: Optional[str] = None            # it will be None somewhere

# Red flag: correlation by time
artifacts = [a for a in store if abs(a.tick - t) < 5]   # guesswork

# Red flag: version strings compared, not behaviour
if deployed.version != validated.version:  ...          # misses an unbumped edit

# Red flag: absent and unavailable collapsed
found = [a for a in stores if a]           # a dead store reads as "no artifact"

# Red flag: a pack with a hole
return EvidencePack(artifacts=whatever_we_found)        # fail instead

# Red flag: unordered chain
head = fold(hash, artifacts)               # two generators, two heads

# Red flag: unprovable treated as fine
if record.region and record.region not in permitted: violation()
# (a missing region silently passes)

# Red flag: the owner validating
inventory.validate(entry_id, validator=entry.owner)     # not independent

In an incident review

• "We couldn't reconstruct it" → no join key.
• "We don't know which documents it saw" → no retrieval snapshot.
• "We don't know if the provider changed it" → no pinned version.
• "The pack was missing the approval" → generated leniently.
• "The inventory said something different" → not the gate.
• "We found agents nobody owned" → no reconciliation.
• "The exit plan didn't work" → never tested with real traffic.

4. Production war stories

The join key added in month seven. A platform ran for six months before anyone asked for an evidence pack. The trace id existed in the traces and nowhere else — not in the policy decisions, not in the inference records, not in the audit log. Six months of production was permanently un-assemblable, and the remediation was a written statement to the regulator that the evidence chain began on a specific date. The examiner accepted it. What they would not have accepted is discovering it during the examination.

The dropped column. Every emitter added trace_id correctly. The audit store's ingestion schema did not have the column, so it was silently discarded on write. Discovered eleven months later, when the first pack was generated and every action artifact was unjoinable. A contract test would have caught it in an afternoon.

"We validated the model." A Tier 1 agent was validated in March. In June somebody edited the system prompt to fix a formatting issue. In September an incident traced to that prompt change, and the validation on file described a system that had not been running for three months. The prompt edit had gone through code review, testing and deployment — every engineering control worked, and the model-risk control did not exist.

The retrieval snapshot. An examiner asked which documents an agent had used for a decision four months earlier. The document ids were recorded. Three of the five had been updated since, and one had been deleted. Nobody could say what the agent actually read. The remediation was an index-snapshot capability that took two quarters, and the finding stood in the meantime.

Bit-reproducibility. A validation pack claimed decisions were reproducible. The validator asked for a demonstration. Temperature was 0.3, the re-run produced a different answer, and the pack's credibility was gone — including the parts that were accurate. The honest claim — the decision context is reproducible, the exact output is not — would have been accepted without comment.

The exit plan. A vendor-risk assessment recorded an alternative provider, an estimated migration time and a runbook. During a real regional outage the failover was attempted for the first time. The prompt behaved differently on the other model, output was 40% longer, three downstream parsers broke, and the token budget was exceeded in ninety minutes. Two days to stabilize, on a plan that had been signed off for eighteen months.

Concentration, measured wrong. The register showed no provider above 60%. It measured per model: three models from one vendor at 30%, 20% and 15%. One outage took 65% of traffic, and the metric had been reported to the board quarterly.

Everything is Tier 1. A tiering scheme with vague criteria. Nobody wanted to defend a lower tier, so every agent was Tier 1: independent validation, board approval, 500 eval cases, annual revalidation. The validation queue reached fourteen months and teams started shipping "prototypes" — outside the inventory, outside the evidence chain — which is precisely what the scheme existed to prevent.

The pack with a hole. The generator returned whatever it found. A pack for a 400,000 AED payment was produced without the approval record, because the approval had been captured in a workflow tool that was never wired in. Nobody noticed for a year; the examiner noticed in four minutes.

The silent control. Egress allow-listing was implemented, tested and effective. It emitted nothing. During an examination "how do you prevent exfiltration?" was answered with a description, and the follow-up — "show me evidence it was operating on 12 March" — could not be answered. The control was working; the evidence did not exist.

The store that was down. Pack generation queried six stores. The search service was down; the generator recorded "no retrieval artifacts" and produced a pack asserting the agent had used no data. It was signed. The bug was one line: absent and unavailable were the same code path.

The removed control. A refactor moved context assembly and dropped the guardrail emit. No error, no test failure — the guardrail still ran, it just stopped recording. Seven months of traces with no guardrail artifacts, found by an auditor sampling for exactly that.

The 2019 archive. Evidence retained seven years, encrypted with a key rotated annually and no key version in the record. Restoring a 2019 record in 2024 required identifying which key by trial. It worked, barely, and the finding was that it worked by luck.

5. The interview signal

Signal 1 — evidence is generated, not assembled. Said early, with the consequence: a reconstruction has gaps it cannot explain, and an examiner probes exactly those.

Signal 2 — join keys are the design, and retrofitting does not fix the past. With the honest implication: you state the date the chain begins.

Signal 3 — the agent configuration is the model. With the empirical argument — two eval runs, same weights, different prompts, 0.94 and 0.71 — rather than a theoretical one.

Signal 4 — tier by impact, and the tier drives the autonomy band. Which makes it an engineering control rather than a register entry.

Signal 5 — the retrieval snapshot. Naming the pin everyone forgets, and why: every other pin is bumped deliberately, the corpus changes continuously by design.

Signal 6 — the reproducibility caveat, volunteered. "The decision context is reproducible; the exact output is not." Claiming more is a claim that gets tested.

Signal 7 — residency from two directions. The topology proof and the per-record check, produced by different systems, failing differently.

Signal 8 — unprovable is a violation. A record with no region is not neutral.

Signal 9 — an exit plan that has never been executed is a document. And the four rungs, with live traffic as the only convincing one.

Signal 10 — measure the degradation, not just success. "On the alternative, quality drops 8% and latency rises 40%" is the answer of somebody who has actually run it.

Signal 11 — a control that emits no artifact does not exist. Followed by naming your silent controls, because knowing which they are is the prepared answer.

Signal 12 — the pack fails loudly. A missing artifact is an engineering ticket during development, not an audit finding two years later.

Signal 13 — absent versus unavailable. Very few people raise it, and it is the bug that produces a confidently-wrong pack.

Signal 14 — you engage the second line at design time. With the framing: their job is to be able to defend the platform, and making them effective is in your interest.

Anti-signals:

• "We log everything."
• "The model" meaning the weights.
• Tiering by technique.
• Validation by the building team.
• Residency asserted from configuration.
• An exit plan with no test date.
• A hand-written coverage matrix.
• "We'll assemble the evidence if we're asked."

The question to ask them: "Six months ago an agent released a payment. Walk me through exactly how you would answer an examiner's question about it — and tell me which part you would not be able to answer." A strong candidate names the six artifacts and their emitters, and then volunteers a genuine limitation: the trace has aged out, or the retrieval snapshot does not exist, or the provider version cannot be excluded. Naming the limitation is the signal.

6. Mentoring notes

Three exercises, in order of how much they change behaviour:

1. Run a mock examination. Pick a real past action. Give somebody uninvolved the six questions and thirty minutes. What they cannot answer is your gap list, and it is more convincing than any design review because it is specific and it is theirs.
2. Show two eval runs, same weights, different prompts. 0.94 and 0.71. Then ask whether the prompt is part of the model. Nobody argues after seeing it, and it takes an afternoon to produce.
3. Ask which documents an agent used last month. Watch them find the ids, then find that two have been updated since. The retrieval snapshot stops being a theoretical pin in about ninety seconds.

And the framing for the platform team: this is the phase where the cost of deferring is asymmetric. Join keys, region fields and derived_from cost nothing at runtime and cannot be added retroactively — the past is simply lost. Everything else in this phase can be built later at ordinary cost. So the sequencing is unusually clear: do the free, irreversible things first, and the expensive reversible things when they are needed.

The argument that gets it funded is not compliance in the abstract. It is: "an examiner will pick one payment and ask six questions. Today we can answer two of them, and the two we cannot answer are about data we are no longer recording. Adding one field to six emitters costs a sprint. Adding it in a year costs a year of un-assemblable history."