Compliance starts before the auditor arrives

Imagine asking a coding agent to restrict customer exports to workspace admins. It could hide the export button, while leaving the server open to anyone who sends a request. How would your team spot that? Assay helps organise the work and the evidence behind it. Let’s follow this example from the request to the release.

First, make the request precise. An admin must be able to export. Everyone else must be denied, even if they bypass the button and contact the server directly. In Assay, you write these conditions in a brief: a work order that tells the agent what to build and tells the checker what to test.

The agent then proposes a code change. A separate reviewer asks whether it actually enforces the rule on the server. That gives the team a chance to catch a hidden button with an unprotected endpoint. The human keeps the merge decision. Separate permissions support that separation; a second agent alone doesn’t guarantee a good review.

After merge, someone who didn’t implement the change checks it on the main branch. Can the admin export? Is the direct non-admin request denied? Assay can record the code version, command and an output fingerprint. Keep the output too, so someone can read the result. If a check cannot run, record that gap.

We now have a request, a review, a check and a decision. We call that linked collection an evidence cabinet. Think of a filing cabinet for the change, where each drawer answers a question. Human design choices go into dated decision records in the repository, linked to their ruling. The cabinet connects these sources so someone can inspect the story.

When you release, Assay’s exporter can collect the declared requirements, work orders and linked evidence into a downloadable pack. Its report shows where work is incomplete or a link is missing. Think of the pack as a snapshot of the declared delivery records. Collecting them doesn’t prove the tests were sufficient. The article includes a real fixture pack you can inspect.

A month later, someone adds an export format. The admin-only requirement still matters. Today, the team must find the earlier decision and requirement, link them in the new brief, and carry the denied request into its checks. The previous result belongs to the previous code. Assay’s records support that handoff; it doesn’t automatically find every applicable rule.

The next step is to make that recall dependable. We’re proposing a query for humans and agents: what decisions and requirements apply to exports? It should return the sources, unresolved conflicts and rules that were replaced, and feed applicable constraints into the next work order. This is feature work, not today’s automation. Source applicability and follow-up records are also planned.

That cabinet helps the next engineer preserve the original permission boundary, as well as investigate an export problem. It’s useful even without SOC 2 obligations. Assay doesn’t confer certification; it helps make decisions inspectable. Start with one consequential change: record the human choice, link the requirement, and carry both into the next change with fresh checks.