Audit evidence on demand, compiled by agents
Every audit season, data and finance teams stop work to screenshot approvals, export access lists and rebuild who changed what. Data Workers keeps a tamper-evident audit trail as the work happens, so SOX, SOC 2 and internal audit evidence is compiled on request, not reconstructed.
Before and after
| Today | With Data Workers |
|---|---|
| Evidence assembled by hand in the weeks before an audit | Evidence compiled from the audit trail on request |
| Screenshots of approvals and exported access lists | A signed record of every change, approver and result |
| "Who changed this table, and who approved it?" answered from memory and chat | Each change traced to its named approver in minutes |
| Auditor follow-up questions that restart the scramble | Follow-ups answered from the same record |
| Controls tested once a quarter | Evidence collected continuously, so gaps show up early |
Auditors sample your controls, and each sample means a data engineer stops shipping to find the ticket, the approval and the change. As agents start touching data, the auditor's first question is what the agent did and who signed off. The requirements for a data agent audit trail are now a standing request, and a SOC 2 review of a data platform asks for the same proof.
How it works
1. Record every action as it happens
Every agent action leaves a tamper-evident audit trail: what was asked, what was approved and by whom, what ran and the result. The Observability Agent reads that record back with get_audit_trail, so evidence exists before anyone asks for it.
2. Tie each change to its data and its policy
The Data Context & Catalog Agent shows what a change touched using get_lineage, and the Data Access & Governance Agent tests access against your policies with check_policy. A sampled change comes back with its approver, its blast radius and the rule it was held to.
3. Compile the evidence pack
The Data Access & Governance Agent assembles the pack per control with generate_audit_report, and you export it for your auditor in one step. Each change carries a signed record that can be verified independently, so the pack stands on its own. Your auditor decides what is sufficient; the Autonomous Data-Conductor keeps the work inside the autonomy each domain allows.
The impact metrics we move
- •Evidence pack for a control sample: from about 2 weeks to 2 h
- •A change traced to its approver: from about a day to under 10 min
- •Auditor follow-up question answered: from about 2 days to under 1 h
Where teams start
- •SOX key controls over financial reporting data. Change approvals and access reviews for the warehouse tables behind the close.
- •SOC 2 evidence for the data platform. Change management and access evidence for Snowflake, Databricks or BigQuery.
- •Quarterly access reviews. Who can read which sensitive tables, with each grant tied to an owner.
- •Internal audit sample requests. A standing pack per control, refreshed on demand.
- •Agent change evidence. The record of what each agent proposed, who approved it and what ran.
What powers it
The audit trail comes with the Data-Agents Swarm: every agent write goes through one approval path and one record, in your own environment if you run it there. Autopilot Routines refresh the evidence on a schedule, and Autopilot Standards hold each domain to the rule your auditor tests. The Spellbook Data Catalog keeps owners and authoritative sources current, which is what lets an approver be named in the first place. The Observability Agent, Data Context & Catalog Agent and Data Access & Governance Agent do the work. Data Workers does not make you compliant; it gives you the controls and evidence, as the guide to SOX, HIPAA, GDPR and the EU AI Act explains. For lineage as audit proof, see data lineage for compliance; for the approvals behind it, how approvals work.
Where this shows up: audit logging, AI agent governance and end-to-end lineage.
The climb: from assisted to autonomous to agentic
Every transformation runs on the same ladder from our thesis: agents first watch and suggest with receipts, then act in approved steps, and a domain moves up only on evidence. L0 to L2 run today. L3 and L4 are where a domain can go once its record earns it.
The pilot
- •Scope. One audit scope, such as SOX data changes or SOC 2 change management for one platform.
- •First week. Agents start by watching and suggesting. They record every action and show the evidence pack they would have compiled.
- •By week two. Routine evidence requests are compiled by the agents; anything sensitive stays with a named approver.
- •At day 30. We review the impact metrics against your baseline:
- •Evidence pack for a control sample: from about 2 weeks to 2 h
- •A change traced to its approver: from about a day to under 10 min
- •Auditor follow-up question answered: from about 2 days to under 1 h
- •Cost. Start with a pilot ($7,500 one-time, credited in full against the first year). Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter and no markup on model spend. See pricing.
FAQ
Does this make us SOC 2 or SOX compliant? No. It produces the evidence; your auditor and compliance lead decide what is sufficient.
Does the audit trail leave our environment? Not if you run Data Workers in your own environment; the records stay on your side.
What stays with people? Approvals, control design and the conversation with your auditor.
Which stacks? Snowflake, Databricks and BigQuery, with dbt and Airflow, among 50+ connectors.
What if the agent is wrong? Every write is previewed and approved first, and the record shows who approved it.