Compliance evidence gatherer
Audit season eats a quarter of your platform team: screenshots, access reviews, configuration exports. You're asked to build an agent that gathers compliance evidence continuously for your certification audits. Evidence integrity is everything here — walk me through what the agent collects, how you maintain a chain of custody an auditor will accept, and what it must never be able to alter. How do you validate that the evidence is complete and untampered, and how do you pitch this to a rightly skeptical compliance lead?
verify_evidence_chain(required_controls: list[str], ledger_records: list[str], current_day: int, max_age_days: int) → list[str][["AC-2","CM-6"],["AC-2,h1,h1,40","CM-6,h2,h2,41"],41,1]out[][["AC-2","CM-6","IA-5"],["AC-2,h1,h9,40","IA-5,h3,h3,30"],41,1]out["AC-2:tampered","CM-6:missing","IA-5:stale"][["AC-2"],["AC-2,h1,h1,41","AC-2,h2,hX,41"],41,7]out["AC-2:tampered"]Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.