Replay: The Operating Layer of Trust

Professional work increasingly takes place across systems that can plan, retrieve, draft, route, approve, update and communicate. That creates a simple governance question: after a consequential action has happened, can an independent reviewer understand what was done and why it was permitted at that exact time?

That question is larger than record keeping. A useful professional record must not merely say that an event occurred. It must preserve enough of the decision context to examine whether the action was justified, authorised and properly bounded. This is the role of Replay.

Replay is more than an audit log

An audit log generally records events in sequence. It may identify who performed an action and when it happened. That is necessary, but it is not always sufficient for consequential professional work.

Replay asks the stronger question: given the request, the evidence, the authority, the governing version and the conditions that existed at the time, should this action have been permitted and did it produce the recorded successor state?

A Professional Anunnaki Twin therefore needs more than a narrative explanation after the fact. It needs a replayable work record. An authorised reviewer should be able to inspect the particular action without relying on a person to reconstruct a lost context months later.

What a material action must preserve

For every material Professional Anunnaki Twin action, the record should preserve:

1. The request: what was asked, by whom and for which matter or purpose.
2. The represented identity: which professional capacity and enterprise boundary applied.
3. The authority in force: the scope, conditions, effective time and expiry of permission.
4. The governing version: the procedure, rule, policy or professional method that applied at the time.
5. The evidence set: the admitted records, sources, observations and known gaps.
6. The decision path: what the system observed, prepared, permitted, refused or escalated.
7. The external effect: what changed in a connected system, communication channel or work record.
8. The outcome receipt: the resulting state, its verification status and the material needed to reperform the result.

This is not surveillance for its own sake. It is the minimum structure required to distinguish a defensible professional action from an unexplained machine event.

Continuous authorisation needs continuous Replay

Authority is not static. A role can change. A credential can expire. Evidence can become incomplete. A connector can be restricted. A human approval can be withdrawn. A professional system must evaluate authority against the live state of the work, not only against a permission granted at an earlier point in time.

Replay makes those time boundaries visible. It should show what authority was active when the action occurred and whether later changes alter the present position without rewriting the history. A revoked permission should stop new work. It should not erase the record of work already performed under a then valid authority.

Evidence must be a byproduct of operation

In traditional assurance, evidence is often assembled later from emails, folders, exports, interviews and memories. That approach becomes weaker as automated work becomes faster and more distributed.

In an Anunnaki.Live workflow, evidence should be produced as the work operates. The Professional Anunnaki Twin should show what it observed, which authority applied, which action it performed, what changed and why the action was permitted, refused or escalated. The professional and any permitted reviewer should not have to begin from a blank page when accountability is required.

Why agentic workflows make the distinction urgent

Agentic systems can decompose work, use tools, read and write records, and move through a sequence of steps. A thin activity log is inadequate when the same workflow may contain preparation, recommendation, authorisation, execution, verification and human reserved acts.

Those stages must remain distinguishable. A Professional Anunnaki Twin may prepare a decision pack. It may identify a missing document. It may perform a permitted system update. It may not silently represent an unmade human judgment, an ungranted authority or an unverified external outcome as complete.

The Anunnaki.Live standard

No professional work outside a bounded role. No action without an evidential basis. No silent handoff. No outcome that cannot be explained and replayed.

Replay converts trust from a general claim into a testable record. The point is not to trust a model because it sounds convincing. The point is to inspect the particular professional work: its inputs, authority, action, result and remaining limits.

What to ask before relying on an AI agent

• Can the system show the exact authority and evidence used for this action?
• Can it distinguish preparation from execution and execution from human approval?
• Can an authorised third party inspect the decision without relying on the operator's memory?
• Can the outcome be recomputed or reperformed from an intact receipt?
• Can the system show what it refused, what remained unresolved and what must return to a human professional?

Those are operating questions, not marketing questions. They determine whether AI assisted work can be governed, challenged and relied upon.

Source and further reading

This article responds to the themes of governance, assurance and AI enabled professional work in ISACA Journal, Volume 5. For a governance as code perspective, see ISACA's governance as code article.