03Trust
Trusting AI in compliance: review what changed, once
Held as a graph, compliance is owned piece by piece: every interpretation, decision, requirement and paragraph carries its own provenance and its own review. No assumption or changed decision slips into a document unnoticed.
You are accountable for what you sign. AI drafts faster than anyone can read, and in a document you cannot see which sentences it wrote, what they rest on, or what else changed. So you either re-read everything, and lose the time AI saved, or sign what you have not seen. In April 2026 the FDA issued what has been called its first warning letter over AI. It went to a drug manufacturer that had let AI agents write its specifications and procedures without reviewing them: "If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP."1
A document system can only hold an approval for the whole document. The interpretations, decisions and requirements underneath are not captured, so they change unseen. In a graph, each of them is held on its own, and every AI change goes through change control one piece at a time: you see what the agent did, you review exactly that, and your approval covers exactly what you saw. Four properties of the system make that hold.
What did the AI do? Provenance down to the paragraph
Every paragraph, interpretation, decision and link carries the change that created it, the change that last touched it, and who made each. An agent writes under its own identity, never a person's, with the model it used and on whose behalf it acted. Data synced from an external system is marked as synced, and that system stays its source of truth (see Compliance as a system of systems). You see the AI's work piece by piece, not as a new revision of a document.
Does my approval still hold? Signatures pinned to content
An approval is an attestation by one person, with its meaning stated, and it covers exactly the content it was given: a paragraph, a plan, a decision, a verdict on whether a clause applies, or a whole document. It cannot be edited. It lapses the moment that content changes, whoever changed it. Edit one paragraph, and that paragraph and its document reopen, while every other paragraph keeps its review.
What else did this change? Impact traced through the graph
Links carry the change. Edit a paragraph, and its consistency check runs against the other paragraphs on the same plan, in every document. Settle a decision or revise a plan, and the checks on everything built on it run again (see Model the domain first). A contradiction is flagged where it is. Then the operator decides: accept the judgement, ask an agent to carry the change through, or revert. Whatever an agent changes comes back for review.
Could the AI approve something? Only people can sign
Who may review a paragraph follows from who is responsible for the obligation it implements; who may release a document follows from the roles in the organisation. A document with AI-generated content cannot be approved until a person has reviewed each paragraph an agent wrote. An agent can draft, check, propose and undo its own mistakes, but the operation that signs exists only for a person with an approving role. An agent holding every tool has nothing to sign with.
Under the hood
Underneath is the version control software teams have trusted for decades, applied to every paragraph, decision and link instead of every file. Every change to controlled content is a commit: who, when, exactly what, and the workspace as a whole at that moment. Each commit's fingerprint is computed from its content and the commits before it. Agents and external syncs write under identities of their own. Permissions are types in our code: a forbidden action, such as an agent signing, does not compile (more in Why we wrote Lumidocs in Rust).
AI drafts and checks. People decide. The history shows which was which. None of it makes the AI right: it makes a wrong judgement visible, and keeps the decision with a person. That is trust you can audit, not trust you are asked for.