AI Agentic Process Audit / Workflow Replay / Assurance Architecture Playbook

配对阅读：本手册的原理/架构解读版是 docs/ai-foundations/papers/161-ai-agentic-process-audit-workflow-replay-assurance-architecture.md。先读 paper 建立机制与取舍，再用本手册落地为模板、RACI 与门禁，两者不需要重复精读。

版本: v1.0 日期: 2026-06-30 定位: 面向金融零售 agentic workflow 的流程审计、工作流重放和保证架构材料。

本文是一份执行型手册, 目标是帮助团队把 agentic workflow 的用户意图、计划、工具调用、HITL 审批、策略决策、例外、补偿动作、输出、反馈和事故学习, 设计成可查询、可重放、可采样、可审阅的 evidence architecture。本文不构成法律意见、监管解释、审计意见、模型验证结论、内控有效性结论或生产批准。它提供的是支持内审、流程 Owner、风险、合规和管理层审阅的证据设计方法。

---

1. Use Conditions

当 AI agent 具备下列任一能力时, 应使用本手册:

Recommended starting use cases:

---

2. Source Anchors

---

3. Delivery Principles

---

4. Execution Roadmap

Step 1: Define The Process Claim

Use this structure:

For [workflow scope], the agent may [allowed responsibility], must not [prohibited responsibility], requires [human or policy control] before [high-impact action], and success is measured by [business outcome] plus [control counterweight].

Completed example:

For payment dispute cases with reason codes 10.4 and 13.1, the assistant may build a sourced evidence packet and draft customer communication. It must not submit a chargeback without maker-checker approval tied to the exact tool input hash. Success is measured by reduced evidence preparation time, lower rework and no increase in unsupported submission exceptions.

Deliverable:

Step 2: Build The Workflow State And Event Map

Deliverable: one event dictionary per workflow, owned by process analysis and architecture.

Step 3: Define The Event Contract

Every event family should use a common envelope:

High-risk tool action payload:

{
  "event_type": "ai.tool.invoked",
  "tool_name": "chargeback_submit",
  "tool_schema_version": "2026-06-15",
  "action_type": "customer_impacting_write",
  "input_hash": "sha256:84bc...",
  "dry_run_result_id": "dryrun_7781",
  "policy_decision_id": "poldec_4320",
  "policy_decision": "approval_required",
  "approval_id": "appr_1109",
  "approval_scope": "chargeback_submit_input_hash_sha256_84bc",
  "side_effect_id": "cb_submit_20260630_9912",
  "idempotency_key": "case_9912_reason_104_attempt_01",
  "compensating_action_ref": "manual_reversal_procedure_v4"
}

Step 4: Build The Evidence Architecture

Minimum architecture:

Agent UI / workflow queue
        |
Agent orchestrator
        |
Policy engine + tool gateway + HITL approval workflow
        |
OpenTelemetry traces + process events
        |
Evidence collector
  schema validation | redaction | hashing | retention tagging
        |
Trace store + event store + evidence lake
        |
Provenance graph
        |
Replay workbench + audit query catalog + process conformance dashboard

Architecture decisions to record:

Step 5: Create Audit Queries Before Release

Audit query catalog:

Step 6: Set Sampling And Testing

Sample test record:

Step 7: Prepare Incident Replay

Incident replay packet fields:

Step 8: Run Process Owner Review

Process owner review should answer:

---

5. Audit Trail vs Observability Design

Use this design split during architecture review:

Operational rule:

No high-risk agentic workflow should pass release readiness if it cannot answer at least one audit query for every high-impact action.

---

6. Evidence Chain Template With Completed Example

Use this completed example as the writing standard.

---

7. Exception And Override Runbook

7.1 Classification

7.2 Override Record

7.3 Escalation

---

8. Segregation Of Duties Controls

Independent challenge checklist:

• Authorized reviewers can query the population without delivery-team manual filtering.
• Reviewers can trace from output to prompt, policy, approval, tool and source system.
• Reviewers can identify missing evidence and classify exceptions.
• Reviewers can see version set and release bundle for the incident window.
• Sensitive evidence can be reviewed under controlled access without broad exposure.

---

9. Process Conformance Dashboard

Dashboard sections:

Conformance thresholds should be risk-tiered. Example:

---

10. Financial Retail Control Patterns

AML Investigation Copilot

Payment Dispute Assistant

KYC Onboarding Agent

Collections Hardship Case Agent

Regulatory Reporting Narrative Drafter

Payment Operations Repair Queue Agent

---

11. Operating Model

11.1 RACI

11.2 Cadence

---

12. 30 / 60 / 90 Day Implementation Plan

Milestone exit criteria:

---

13. Anti-Patterns And Corrections

---

14. Replay Assurance Decision Logic

14.1 Auditability for AI agents that execute workflow actions

Core pattern:

Auditability starts with process claims and then instruments the agent as an event-sourced workflow. Every high-impact action needs evidence for intent, plan, policy decision, tool input, approval, side effect, output and feedback. OpenTelemetry traces connect to a domain event store and provenance graph, while audit queries and sampling are defined before release.

Expanded logic:

For an agentic workflow, auditability cannot be bolted on by saving chat transcripts. The business process claim comes first: for example, a dispute assistant may draft evidence packets but cannot submit a chargeback without maker-checker approval. That claim becomes requirements and controls.

Architecturally, the orchestrator emits events for intent, plan, observations, policy decisions, tool dry-runs, approvals, tool executions, outputs, exceptions and feedback. The tool gateway enforces policy, idempotency, approval binding and side-effect logging. The HITL workflow records what the reviewer saw, what they decided, and the reason. OpenTelemetry gives operational traces, while the event store and provenance graph provide business replay and causal evidence.

Before release, audit queries are defined for cases such as all customer-impacting actions without valid approval, all outputs delivered after approval but changed from the approved draft, and all expired exceptions. A risk-based sampling plan follows. This does not create audit sign-off by itself, but it gives process owners, risk and internal audit partners a strong evidence base for review and challenge.

14.2 Workflow replay under LLM nondeterminism

Core pattern:

Exact reproduction should not be promised. Replay preserves the version set, prompt/config hash, model route, retrieved chunks, policy decision, tool inputs, approval records, output hash and business system state. Replay reconstructs evidence and control behavior, while documenting model nondeterminism and vendor version limits.

14.3 Audit query quality for agentic workflows

Core pattern:

A good audit query tests a process claim or control, not just a log field. For example: show all payment repair tool executions where the action was customer-impacting and the approval was missing, expired, scoped to a different input hash or performed by the requester.

14.4 Distinguishing justified exception from control failure

Core pattern:

A justified exception has an authorized reason, owner, expiry, compensating control and closure evidence. A control failure means a required control was absent, bypassed, expired or mismatched. The replay evidence should support that classification through policy, approval, tool and exception events.

14.5 Monthly process-owner review

Core pattern:

The process owner should see workflow volume, required event coverage, process conformance, open and expired exceptions, approval quality, tool action controls, outcome metrics, control counterweights, incidents, evidence gaps and management actions with owners and due dates.

---

15. Replay Assurance Lab

Build a replay assurance pack for the KYC onboarding agent.

Completed scenario:

The KYC onboarding agent classifies submitted documents, identifies missing beneficial ownership evidence and drafts customer follow-up messages. It cannot reject an applicant or mark onboarding complete without human review. High-risk jurisdiction cases require senior reviewer approval. Success is measured by reduced document rework and faster first-pass completion, with no increase in complaint, appeal or QA exception rates.

Required artifacts:

Evaluation rubric:

---

16. Self-Check Checklist

---

17. Closing Synthesis

Agentic workflow replay is mature when a process owner can say:

The organization knows what the agent was allowed to do, what it actually did, what evidence it used, who approved high-impact actions, which exceptions were justified, which controls failed, how outcomes changed and what the incident record taught.

For governance, architecture and process teams, this is the difference between workflow automation and workflow assurance.