Jon Odalen

Founder & CEO @WeaveframeAI. Independent assurance for AI agents. 25 years in enterprise tax, compliance and finance software.

[Jon Odalen @Jon_weaveframe]

25 years in tax and compliance software taught me one rule auditors never bend: the system under audit is never its only witness.

Agents now post entries and release payments. Same rule. The system that performs the action should not be the only system vouching for the action.

[Jon Odalen @Jon_weaveframe]

@Corix_JC @SiliconANGLE @theCUBE @duncanriley @CowbellCyber Underwriters are going to ask something most agent deployments can't answer yet: when the agent caused the loss, what did it actually do, and on whose authority? A claim gets messy fast if the only record is the agent's own log.

[Jon Odalen @Jon_weaveframe]

BDO's 2026 Audit Innovation Survey: 47% of finance leaders are already piloting or deploying agentic AI. 49% say they have the documentation and processes to explain and substantiate all AI-assisted outputs.

Which leaves roughly half without that record.

https://t.co/qAIGYW2pVD

[Jon Odalen @Jon_weaveframe]

@sheppaj Identity and least privilege cover what the agent was allowed to do. After an incident the harder question is what it actually did, and that record carries more weight when it doesn't come from the same stack that ran the agent.

[Jon Odalen @Jon_weaveframe]

The OCC's examiner framework for banks' use of AI says records of tool calls, approvals, overrides and actions may support reconstructing a material decision. The audit section then asks about access to underlying evidence, not management summaries.

Who wrote the record matters more than how long it is.

https://t.co/hGJhwyIGwz

[Jon Odalen @Jon_weaveframe]

94% have AI governance policies.

80% have deployed AI agents.

But only around half report ongoing monitoring controls.

That’s the governance gap identified in the Bank of England/FCA’s October 2026 AI survey.

As AI agents gain authority to act, enterprises need more than policies and guardrails.

They need evidence of what actually happened.

From policy to proof.

Weaveframe | Independent Agent Assurance

Source: Bank of England/FCA 2026 AI Survey.

[Jon Odalen @Jon_weaveframe]

@agenticbanker Tiering by cost of an error makes sense, but examiners will still want a record of what the payment agent actually did that doesn't come from the system running it. Self-reported logs are a thin basis for a Tier 1 conversation.

[Jon Odalen @Jon_weaveframe]

@kuppingercole Where the control sits matters, but so does what happens when it's tested. Whether the data said no or let something through, the record of what the agent actually attempted should be written somewhere the agent can't reach.

[Jon Odalen @Jon_weaveframe]

@MSFTMechanics Blocking unapproved MCP tools by default and scoping approved servers per agent is a sensible place to start. After the run, finance still asks which tools the agent actually called and under whose authority, from a record the agent didn't write.

[Jon Odalen @Jon_weaveframe]

@rtehrani Same gap shows up with AI agents. Teams stack up controls on what an agent is allowed to do, and very few can show, from evidence the agent didn't produce, what it actually did.

[Jon Odalen @Jon_weaveframe]

@AdamDiStefanoAI Revoking access is the control. The harder check is whether queued work still ran, and whether you can see that from evidence the agent didn't write. Governance tells an AI agent what it should do. Assurance establishes, from independent evidence, what it actually did.

[Jon Odalen @Jon_weaveframe]

@Hamid_Mazloomi I'd add one more test after the delegation decision. Once the agent has acted, can you tell what it did from evidence it didn't write? Governance tells an AI agent what it should do. Assurance establishes, from independent evidence, what it actually did.

[Jon Odalen @Jon_weaveframe]

@Jamessfbay When the agent can act on its own, the evidence that justifies the action can't come only from the agent. Governance sets the boundary. Assurance has to establish, from independent evidence, what actually crossed it.

[Jon Odalen @Jon_weaveframe]

@YoussefMrini @databricks Logging every turn is the right start. The harder test is checking that trace against what actually changed in the data. Governance tells an AI agent what it should do. Assurance establishes, from independent evidence, what it actually did.

[Jon Odalen @Jon_weaveframe]

@rtehrani Governance requirements on the checklist are easy to check as features. Harder is whether you can reconstruct what the agent did after the fact from something other than its own log. That's usually where the platform comparison goes soft.

[Jon Odalen @Jon_weaveframe]

@CyberSecDive @ericgeller A stable baseline helps, but normal behavior is not the same as authorized behavior. For a consequential run, the record should tie each action to the agent identity and authority in force at that moment. How are teams making that link durable?

[Jon Odalen @Jon_weaveframe]

@okta @auth0 Confirming a real, authorized shopper sits behind the purchase covers the front half. The back half is showing afterward that the authority was still valid when the agent acted, from a record the agent didn't write.

[Jon Odalen @Jon_weaveframe]

@Sarah_Cecc @bot @clawdreyhepburn Separate identities make the blame traceable, which helps. What's still missing in most setups is a record kept outside the agent of what that identity actually did and whose authority it was running on at the time.

[Jon Odalen @Jon_weaveframe]

@holgermu @Snowflake Not a higher standard, a different one. A person's login trail shows who touched the system, but an agent can take hundreds of steps under one approval, so what matters is whether each consequential action still had valid authority behind it.

[Jon Odalen @Jon_weaveframe]

@DavidLinthicum The step every one of those cycles skips is the after-the-fact question. Once agents act inside finance or ops systems, someone outside the agent has to be able to say what it actually did, and most designs only plan for that when an auditor asks.