Why segregation of duties exists
Segregation of duties separates incompatible responsibilities: authorizing a transaction, executing it, recording it and reviewing it. The COSO Internal Control framework, widely used as the basis for internal control over financial reporting, lists segregation of duties among the considerations for control activities. Its purpose is often described in terms of fraud, but its more fundamental purpose is error detection.
A person who performs a task and then checks their own work tends to check it against the same assumptions they used to do it. If the assumption was wrong, the check inherits the error. A second party, working from a separate reference such as the approved vendor list, the contract or the delegation of authority, is positioned to see what the first party could not. The value of that separation does not depend on anyone behaving badly. It depends only on the fact that no single vantage point sees everything.
The same reasoning underpins auditor independence and the separation between management and internal audit in most governance models. Assurance is credible in proportion to its separation from what is being assured.
Agents combine roles by default
A human process spreads authorization, execution, recording and review across people and systems almost by accident. An AI agent tends to concentrate them.
A single agent may interpret a request, decide it is permitted, carry it out through a tool, write a record of what it did, and report that the task succeeded. Each of those steps may be performed well. But structurally, the agent is authorizer, executor, recorder and reporter at once. If its interpretation of its mandate was wrong, every downstream artifact it produces, including its log and its summary, will be consistent with that wrong interpretation.
This is not a defect of any particular agent or vendor. It is a property of the architecture. The more autonomy an agent has, the more roles it holds.
Logs and self-checks are necessary, and not sufficient
Agent platforms increasingly provide detailed logs, traces, guardrails and self-evaluation. These are valuable, and any serious assurance approach depends on them.
The question is not whether these records are accurate. It is what role they can play. Three distinctions matter.
Recording is not reviewing. A log records what a system did and observed. Deciding whether that action was authorized requires comparing it to something outside the system: the policy, the delegation, the approval. A platform can evaluate the policy it holds. A log of that evaluation still does not, by itself, establish the business authority then in force, or confirm the result in an authoritative system of record.
Self-evaluation shares the actor's frame. When an agent, or a component built alongside it, evaluates its own action, it applies its own understanding of the rules. That is useful as a first line of defense. It cannot, by construction, catch cases where its understanding of the rules was the problem.
A single source cannot corroborate itself. In financial controls, a reconciliation compares two independently produced records, such as the ledger and the bank statement. Agreement between them means something because they were produced separately. An agent's report that a payment succeeded, checked only against the agent's own log, is one source consulted twice.
None of this makes logs less valuable. It clarifies that they are evidence inputs, and that the conclusion drawn from them should come from somewhere else.
What independence requires for agents
Applying segregation of duties to AI agents suggests a few practical requirements.
An evaluator outside the execution path. The layer that determines whether an action was within authority should not be part of the agent's own reasoning loop, and should not be controlled by the same configuration that governs the agent.
References the agent did not write. The standard applied should come from authoritative sources: approved policies, delegations of authority, approval matrices, and applicable law and regulation. Where no such reference exists, the honest finding is indeterminate. The evaluator should not infer what the organization probably meant.
Corroboration against systems of record. Where an action changes the state of another system, such as a payment, an entitlement or a filing, the conclusion should be checked against that system, not only against the agent's account of it.
Preservation for reconstruction. A reviewer months later should be able to reconstruct what happened and why the finding was reached, using the policy versions and evidence that applied at the time.
Attention to the whole trajectory. Segregation of duties in finance guards against a sequence of individually valid steps that together produce an improper result. For agents, the equivalent question is Authorization Continuity: whether the full sequence of actions stayed within the original mandate, not only whether each step was permitted. The term appears in prior work by Zhang & Zhang (arXiv 2607.23586, July 2026) on whether authorization survives changes to an evolving agent; Weaveframe applies it to the trajectory of the run.
Who this is for
The principle matters most when the person relying on the result is not the person who built the agent. Internal audit, risk and compliance teams, customers, external auditors and regulators all need to reach conclusions about agent behavior without relying solely on the builder's account.
For them, the relevant question is not "is this agent well engineered?" It is "who, other than the agent, established that this action was legitimate, and on what basis?"
A familiar principle, applied to a new actor
Nothing here is novel as a control principle. It is the oldest idea in internal control, applied to a new kind of actor. What is new is that the actor can choose its own steps, act at machine speed, and produce a fluent, plausible account of its own work.
That makes the principle more important, not less. The system that performs the action should not vouch for the action.
Related: What Is Agentic Assurance? → Independent Agentic Assurance white paper →