--- title: "The audit trail your auditors will ask about: making Dynamics 365 agents auditable" canonical_url: "https://cognilium.ai/blogs/making-dynamics-365-agents-auditable" slug: "making-dynamics-365-agents-auditable" section: "blogs" date_published: "2026-10-12" date_modified: "2026-10-12" word_count: 625 reading_time_minutes: 3 author: "Mudassir Marwat" author_identifier: "0009-0008-1927-2598" person_same_as: - "https://www.linkedin.com/in/mudassir-marwat/" - "https://orcid.org/0009-0008-1927-2598" - "https://github.com/mudassirmarwat" - "https://medium.com/@mudassir-marwat" - "https://www.youtube.com/@mudassir-marwat" - "https://dev.to/mudassirmarwat" - "https://hashnode.com/@mudassirmarwat" - "https://huggingface.co/mudassirmarwat" - "https://bsky.app/profile/mudassir-marwat.bsky.social" - "https://substack.com/@mudassirmarwat" - "https://topmate.io/mudassirmarwat" - "https://fueler.io/mudassirmarwat" - "https://www.instagram.com/mudassirmarwat/" - "https://www.facebook.com/mudassir.marwat" - "https://www.reddit.com/user/mudassirmarwat/" - "https://www.f6s.com/member/mudassir-marwat" - "https://cognilium.ai/founder" entities: [] related: [] --- # The audit trail your auditors will ask about: making Dynamics 365 agents auditable Before an AI agent touches your general ledger, your auditors will ask three questions: who authorised it, what did it do, and can you prove it. Here's how to make Dynamics 365 agents auditable — approval, segregation of duties, and a trail. There's a moment every finance leader hits when they move from "AI agents are exciting" to "AI agents are touching the general ledger": the audit question. Because the first time an agent posts a journal, creates a PO, or clears a reconciliation, your auditors — internal and external — will ask the same three things they'd ask about any person who did it: 1. **Who authorised this?** 1. **What exactly did it do?** 1. **Can you prove it?** If you can't answer all three for every agent action, the agent isn't ready to touch the ledger — no matter how good it is. Auditability isn't a feature you add later; it's the thing that lets finance say yes in the first place. ## Why an agent raises the bar, not just meets it A human in your finance team is already inside your control framework: they have a named identity, a role with defined permissions, and they leave a trail. An agent has to be held to the *same* standard, and that's harder than it sounds, because an agent acting for a user currently inherits that user's permissions and acts on instructions — fast, at volume. So the controls that were implicit for a person have to be made explicit for an agent: - **Identity and authorisation.** Every action attributable — not just "a user's agent did it," but which instruction, approved by whom. - **Segregation of duties.** The agent must not be able to both create and approve the same transaction. If a human role quietly accumulated both, that's the first control to split before the agent inherits it. - **Approval before anything irreversible.** The ledger-touching, cash-moving, PO-creating actions sit behind a human approval, by design — the pattern Microsoft's own flagship demo uses. - **A complete, queryable trail.** Instruction → data read → recommendation → approval → action → record touched. Not a log you hope exists, but evidence you can hand an auditor. ## The three questions, made answerable **"Who authorised this?"** — Build so that every agent action carries the instruction that triggered it and the person who approved it. An agent action with no named approval behind an irreversible step is the finding an auditor will write up. **"What exactly did it do?"** — Capture the reasoning, not just the result. The agent's summary of *why* it acted — which rule, which match, which exception — is what turns "the system did it" into something a controller can stand behind. **"Can you prove it?"** — Keep the trail durable and queryable, tied to the record. "We think it worked correctly" is not an audit answer; "here is the instruction, the approval, and the before/after on the record" is. This is also why the governance work and the audit work are the same project: scoping what an agent is allowed to do ([the governance gap](/blogs/dynamics-365-agent-governance-gap-close-it-first)), exposing only governed operations ([MCP Action tools](/dynamics-365/mcp-server)), and recording every one of them, are three faces of making an agent safe to trust with the books. ## The order of operations Get this done *before* you scale agents, not after an auditor asks. The sequence: 1. Fix segregation of duties on the roles agents will inherit. 1. Make approval-before-posting architectural for anything irreversible. 1. Build the trail — instruction, approval, action, record — as evidence, not an afterthought. 1. *Then* widen the agent's remit, one process at a time. Do it in that order and agents become something your audit committee signs off on, instead of something they freeze. Do it backwards and the first audit stops the programme. If you're putting agents anywhere near the ledger and want the control and audit architecture sorted first, [tell us what your controls and approvals look like today](/contact) — the honest first step is usually "make this auditable before you scale it." ## Frequently asked questions ### How do we keep AI agents auditable in Dynamics 365? Make every agent action attributable to an instruction and an approval, enforce segregation of duties so an agent can't create and approve the same transaction, gate irreversible actions behind human approval, and keep a complete, queryable trail from instruction to record. ### What will auditors ask about AI agents? Who authorised the action, what exactly it did, and whether you can prove it. If you can't answer all three for every ledger-touching action, the agent isn't ready for it. ### Do AI agents break segregation of duties? They can, if they inherit a role that holds both create and approve rights. Splitting those on the roles agents will use is the first control to fix. ### Should an agent post to the general ledger automatically? Not without a human approval on the irreversible step. The agent prepares; a person approves before it posts. ### Is agent governance separate from agent audit? No — they're the same project: scope what the agent can do, expose only governed operations, and record every action. Governance is control; audit is the evidence of it. --- Canonical HTML: https://cognilium.ai/blogs/making-dynamics-365-agents-auditable