# Evidence Packer: An AI Agent That Assembles Audit Evidence

The Evidence Packer is an AI agent that assembles consent history, decision reason codes and agent runs from a customer data platform (CDP) to answer a logged audit question. Compliance teams use it at L1 for read-only lookups and at L2 for draft packs. It states gaps plainly. It never alters a record, releases a pack or states a compliance conclusion.

Within the [AI agent rails](https://privycdp.org/ai/rails) method, this agent reads the record other agents leave behind. The process is in [audit evidence packs with an AI agent](https://privycdp.org/ai/rails/use-cases/audit-evidence-packs).

## Rail at a glance

The Evidence Packer's rail gives it read-only ledger views and identifiers by reference. The ledger writer sits outside the agent, which has no path to edit what it cites.

| Field | Value |
|---|---|
| Job | Assemble consent history, decision reason codes and agent runs to answer an audit question. |
| Trigger | An audit or regulator question logged by compliance. |
| Data scope | Audit ledger, consent ledger with identifiers by reference, rail cards and policy versions. |
| Tool scope | Read: ledger views, rail cards, policy versions; propose: an evidence pack with an index; execute: none. |
| Output contract | Question, evidence index, ledger references, and gaps stated plainly. |
| Gate | The compliance lead reviews and releases every pack. |
| Limits | Read-only ledger views, identifiers by reference, and no outbound tools. |
| Ledger | Question hash, entries cited, pack version, releaser. |
| Evaluation | Past audit questions with accepted answers, plus seeded gaps. |
| Owner and kill switch | Compliance lead; an [Orchestrator](https://privycdp.org/ai/rails/orchestrator-agent) pause stops the agent, and people keep their ledger access. |

## What it does and who uses it

The Evidence Packer turns a logged question into an indexed set of records a compliance lead can check. At L1, an analyst asks lookups, such as which rail version applied on a given date. At L2, it drafts a full pack for review.

Illustrative run: an internal auditor asks compliance to show that recipients of a March win-back campaign had email consent at send time, and who approved the audience. Compliance logs the question. The packer returns an index: the segment approval entry, the sync record, consent-check IDs, the rail card, and the policy version in force that day. Its gaps section says consent-check IDs are absent for one 40-minute window on 14 March. The compliance lead investigates, finds a ledger-writer outage and a rule log covering the period, and adds an explanation before release.

The line between evidence and opinion is worth writing down, because models tend to finish with a tidy conclusion. These example sentences are illustrative.

| Draft sentence | Allowed? | Reason |
|---|---|---|
| "Entry 2041 records approval by the marketing-operations reviewer on 12 March." | Yes | A fact with a reference. |
| "No consent-check ID was found for sends between 14:00 and 14:40 on 14 March." | Required | A gap stated plainly. |
| "The gap is probably harmless." | No | A judgement about materiality. |
| "All recipients had valid consent." | No | Prose cannot stand in for a rule result, so cite the check, its scope and its outcome. |
| "The campaign complied with GDPR Article 7." | No | A compliance conclusion, which belongs to a person. |

## Why this level

Evidence work splits across two levels because a lookup and a pack carry different risks. The analyst who asked catches a wrong lookup. A pack stays a draft until release, but after release an error sits in front of an auditor or regulator and is hard to take back. Article 5(2) of the General Data Protection Regulation (GDPR) places the duty to demonstrate compliance on the controller, and Article 7(1) does the same for consent [2](#source-2)[3](#source-3). A model cannot carry that, so the Evidence Packer stops at L2.

Rule of Two reasoning sets the tool list [1](#source-1). Audit questions often arrive as forwarded letters or emails, so the question text is untrusted. Ledger and consent references are sensitive. With two properties held, no tool may change state or send anything, so a person carries the released pack out.

Teams can start at L1 and add packs once seeded-gap results are written up and the compliance lead signs off. Expect a released pack to be re-performed, not taken on trust: auditors are expected to test company-produced information for accuracy and completeness, or test the controls over it [4](#source-4).

## Three ways it fails, and the control for each

Evidence packs fail by looking more complete and more certain than the records allow.

| Failure | What it looks like | Control |
|---|---|---|
| Gaps smoothed over | A retention window or ledger outage removes records, and the summary reads as complete. | Code compares expected and found counts for the period and writes the gaps section. A pack cannot be produced with that section missing. |
| Invented or stale reference | The model cites an entry that does not exist, or today's policy instead of the version in force on the event date. | A resolver checks each reference against the ledger before a person sees it. Code joins policy and rail versions by effective date. |
| Conclusion creep | "This demonstrates compliance" slips into a summary, and an auditor reads it as the company's position. | The output schema has no conclusion field, a wording check flags such phrases, and each pack stays a draft until the compliance lead releases it. |

## How to evaluate it

An evidence agent earns trust when someone can rebuild a pack by hand and reach the same index. Start from past audit questions with accepted answers, and add seeded gaps.

- **Gaps found on seeded sets.** Hide test records from the view to mimic an outage, and require every absence to appear in the pack.
- **Time to answer,** from question logged to a pack ready for review.
- **Packs returned by auditors,** with reasons.
- **Gaps found before an audit,** which the team should welcome.
- **Blocked references.** The resolver stops bad citations, and the count shows how often the model invents them.
- **Re-performance.** Rebuild a sampled pack from the ledger each quarter and compare the two.

## Where it runs

Identifiers stay by reference, but ledger entries still describe customer decisions. A private model is therefore preferred, with an external one allowed only under masking and contract cover, as the [boundary architecture patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary) explain. [PrivyCDP](https://privycdp.org/cdp) keeps an immutable audit ledger recording each AI-assisted action with the human or system actor that authorised it, and this agent is a method for reading such a record, not a product feature.

## Related

- [Audit evidence packs with an AI agent](https://privycdp.org/ai/rails/use-cases/audit-evidence-packs): the workflow behind each pack.
- [AI agents for compliance, privacy and security teams](https://privycdp.org/ai/rails/functions/compliance-privacy-security): the wider compliance playbook.
- [Explainable AI for customer decisions](https://privycdp.org/ai/explainable-ai-customer-decisions): what auditors ask about a decision.
- [Rail card template](https://privycdp.org/tools/agent-rail-card): the claim an auditor compares with the ledger.


The [AI agent rails hub](https://privycdp.org/ai/rails) links the agents whose runs this one reads. The [rail card template](https://privycdp.org/tools/agent-rail-card) helps you set a release gate before the next audit question arrives.

Rail level: L1 to L2 · Risk: medium · Function: compliance privacy security

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Can an AI agent collect audit evidence?

Yes, within limits. It can search read-only ledger views, build an index and flag what is missing. People remain responsible for checking the pack, deciding what it means and releasing it.

### Does an evidence pack prove compliance?

No. A pack shows which records exist and where they stop. Whether those records meet a legal or audit standard is a judgement for your compliance lead, counsel and auditor, so the agent never states a conclusion.

### What should a pack do about missing records?

Name them plainly, with the period and the check that found the absence. An honest gap gives the team a chance to explain it or fix the cause.

## Sources

1. Meta, Agents Rule of Two, on sessions that read outside text: https://ai.meta.com/blog/practical-ai-agent-security/
2. GDPR Article 5, accountability: https://gdpr-info.eu/art-5-gdpr/
3. GDPR Article 7, demonstrating consent: https://gdpr-info.eu/art-7-gdpr/
4. Schneider Downs, on testing information produced by the entity, citing PCAOB expectations: https://schneiderdowns.com/our-thoughts-on/ipe-understanding-information-produced-by-entity/

This article is general information, not legal advice.

## Further reading

- [AI Agents for Compliance, Privacy and Security Teams: The Playbook on Rails](https://privycdp.org/ai/rails/functions/compliance-privacy-security)
- [Audit Evidence Packs: Answer Auditors With an AI Agent on Rails](https://privycdp.org/ai/rails/use-cases/audit-evidence-packs)
- [Access Review Assistant: An AI Agent for Least-Privilege Reviews](https://privycdp.org/ai/rails/agents/access-review-assistant)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)