Part 1 introduces controlled agentic workflows for due diligence, explains why traditional AI logs fail regulated teams, and defines audit-trail-first reasoning as the foundation of defensible automation in professional services.
M&A, legal, audit, and compliance teams now routinely use LLMs and agentic systems to pre-analyse contracts, flag anomalies, and draft narratives for partners and regulators.
But in these domains, stakeholders care as much about how the conclusion was reached as about what the conclusion is, because the reasoning itself is subject to regulatory and professional scrutiny. This exposes a core operational gap: traditional observability tools like Datadog or OpenTelemetry are built to log technical HTTP payloads, latencies, and error traces for SREs debugging system performance; not to produce the governance-linked provenance that legal and financial auditors require. The shift due diligence teams actually need is from APM (Application Performance Monitoring) to Auditability; reframing this from a debugging problem into a compliance and evidentiary lineage problem, where the objective isn't "is the system fast and available" but "can every conclusion be traced back to its evidence, policy, and human authorisation.
Most LLM deployments optimise accuracy, latency, and token cost, while traditional application logging focuses on API request/response blobs keyed by technical identifiers like API keys or IP addresses.
Regulated professional services instead need Deterministic AI Governance: a system where agent behavior is bounded by explicit policies rather than emergent model behavior combined with Tamper-Evident Logging that connects each conclusion to evidence, policies, and explicit human approvals over time in a way that cannot be silently altered after the fact.
An LLM behind a chat box is a feature; a controlled agentic workflow is a system where AI agents, policies, and humans collaborate in a governed multi-step process.
In due diligence, that system must embed guardrails around which agents can act, what evidence they can touch, and when they must stop and surface their reasoning to a partner or auditor.
A controlled agentic workflow for due diligence is best understood not as a chatbot with tools, but as a deterministic execution graph: a finite state machine where each node is a specialised agent, and transitions between nodes are hard-coded by a policy router rather than left to the LLM's own discretion. This distinction matters because it constrains what would otherwise be probabilistic, non-reproducible LLM behavior into a fixed set of allowed state transitions ; the agent can reason freely within a state, but it cannot decide which state comes next; that boundary belongs to deterministic policy logic.
A controlled agentic workflow for due diligence typically includes:
This state-machine framing is what turns "AI helper for associates" into infrastructure your firm is willing to stand behind in court or regulatory reviews ; because you're no longer defending an LLM's judgment, you're defending a deterministic, auditable execution path with bounded, verifiable agent behavior at each step.
The EU AI Act does more than gently recommend logging; it hard‑codes traceability into law for high‑risk AI systems.
Article 12 (“Record‑keeping”) explicitly requires that “high-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system”, making architectural logging a mandatory capability, not an optional best practice.
Article 12(2) then sets the standard: logging must provide a level of traceability appropriate to the system’s intended purpose, sufficient to identify risk situations, support post‑market monitoring, and enable deployers to oversee ongoing operation.
In practice, guidance around the Act interprets this as machine‑generated logs that allow reconstructing the system’s behavior and every algorithmic decision across its lifecycle not manual notes or selectively enabled debug logs.
Operationally, Article 12 sits at the center of a broader record‑keeping stack: providers and deployers of high‑risk AI must design systems that automatically generate event logs, retain them for at least a minimum period (reinforced by Article 19), and keep them intact and accessible for market surveillance authorities on request.
Commentary for engineering teams emphasises that “automatic” means logs are produced as a side effect of the system running, with stable request IDs, model/version identifiers, input hashes, and downstream actions, all forming a chain that regulators can replay.
For M&A, legal, audit, and compliance workflows that qualify as high‑risk AI use cases under Annex III, this converts traceable automation from a strategic differentiator into a hard compliance requirement: if you cannot reconstruct what your due diligence agents did, under which policies, and with which model versions, you are out of compliance as a matter of law.
Controlled agentic workflows with hash‑chained, identity‑bound audit trails are a direct architectural response to Article 12’s mandate for automatic, lifecycle‑long event recording and risk‑oriented traceability
Reasoning-capable models and chain-of-thought outputs seem attractive: ask the model to “show its work” and log the explanation alongside the answer.
But in practice, studies and field experience show that reasoning traces often violate instruction structure or omit required justifications as tasks get complex, even when final answers appear reasonable.
A detailed analysis in legal AI found that a large share of reasoning traces failed to follow requested formats or evidence-citation rules, making them hard to use as reliable audit artifacts.
Without structure, these traces are verbose text that cannot be easily versioned, compared across cases, or replayed programmatically.
To address this, some systems use concept bottlenecks and structured reasoning outputs: instead of free‑form text, the model is constrained to emit scores across a fixed set of domain concepts (legal principles, risk dimensions, control objectives), all validated against a JSON Schema or equivalent contract.
Modern “structured outputs” modes from providers like OpenAI, Anthropic, and Gemini push this enforcement to the API boundary, guaranteeing that responses conform to developer‑supplied schemas rather than relying on prompt discipline alone, which is essential for preventing schema drift when models or prompts change over time.
Crucially, free‑form reasoning traces cannot be programmatically validated, profiled, or indexed in downstream relational stores or analytics pipelines; they’re opaque blobs.
Schema‑enforced artifacts, by contrast, transform qualitative model logic into quantitative, queryable data vectors: you can run JSON Schema or Zod/Pydantic validation, store fields as typed columns, and slice risk scores, exception rates, and reasoning coverage with SQL or warehouse queries, turning the agent’s “thought process” into metrics, dashboards, and alerts.
A published example projects legal texts into a 24-dimensional space of legal principles with scores in [0,1][0,1], enforced with strict schema validation at the API boundary, yielding comparable and auditable outputs rather than free-form essays.
Plain-language explanations still help humans, but enterprise-grade audit requires schema-constrained reasoning artifacts that are stable, versioned, and machine-checkable.
Recent work proposes that an LLM/agent audit trail should be “a chronological, tamper-evident, context-rich ledger of lifecycle events and decisions that links technical provenance with governance records.”
This definition implies that logs must support reconstruction of what happened, why, under which policies, and under whose authority, not just list API calls.
Five key properties emerge:
Specialised platforms implement hash-chained logs where each entry includes its own hash and the previous entry’s hash, plus identity, environment, and policy metadata.
This is the level of rigor due diligence workflows must adopt as they transition from ad hoc AI usage to deeply agentic architectures.
Below is a minimal Python implementation of a tamper-evident audit log using a hash chain you can embed in a due diligence platform’s logging sidecar:
from __future__ import annotations
from dataclasses import dataclass, asdict
from datetime import datetime, timezone
from hashlib import sha256
from typing import Any, Dict, List
import json import uuid
GENESIS_HASH = "GENESIS"
def now_epoch_seconds() -> int:
# Canonical event timestamp
return int(datetime.now(timezone.utc).timestamp())
@dataclass
class AuditEvent:
"""Single immutable event in the audit chain."""
event_id: str
case_id: str
agent_id: str
actor_id: str # Human user or service account
event_type: str # Example: "CLAUSE_RISK_SCORED"
payload: Dict[str, Any]
occurred_at: str
prev_hash: str
chain_hash: str
@staticmethod
def compute_hash(prev_hash: str, event_id: str, occurred_at: str) -> str:
"""Create a deterministic hash for the current event."""
payload = f"{prev_hash}|{event_id}|{occurred_at}"
return sha256(payload.encode("utf-8")).hexdigest()
class AuditLog:
"""In-memory, hash-chained audit log."""
def __init__(self) -> None:
self._events: List[AuditEvent] = []
@property
def last_hash(self) -> str:
return self._events[-1].chain_hash if self._events else GENESIS_HASH
def append(
self,
case_id: str,
agent_id: str,
actor_id: str,
event_type: str,
payload: Dict[str, Any],
) -> AuditEvent:
occurred_at = now_epoch_seconds()
event_id = str(uuid.uuid4())
prev = self.last_hash
chain_hash = AuditEvent.compute_hash(prev, event_id, occurred_at)
event = AuditEvent(
event_id=event_id,
case_id=case_id,
agent_id=agent_id,
actor_id=actor_id,
event_type=event_type,
payload=payload,
occurred_at=occurred_at,
prev_hash=prev,
chain_hash=chain_hash,
)
self._events.append(event)
return event
def verify_chain(self) -> bool:
prev = GENESIS_HASH
for e in self._events:
expected = AuditEvent.compute_hash(prev, e.event_id, e.occurred_at)
if e.chain_hash != expected:
return False
prev = e.chain_hash
return True
def to_jsonl(self) -> str:
return "\n".join(json.dumps(asdict(e)) for e in self._events)
In enterprise production, a hash chain in a mutable database is only half the story. The other half is anchoring the latest chain_hash (or a batch Merkle root) to an external, write‑once immutable store so that even a rogue DBA cannot silently rewrite history and recompute hashes offline.
Common anchoring targets include:
M&A legal due diligence – Agents ingest data rooms, extract clauses (e.g., change of control, indemnities, non-competes), map them to risk categories, and produce structured issue lists for partner review.
SoW due diligence in private banking – Multi-agent systems simulate human SoW analysts by extracting categories, corroborating claims across documents and external sources, performing gap analysis, and emitting evidence-linked SoW narratives.
Audit and compliance investigations – Agentic workflows collect evidence, evaluate it against policies, classify alerts, and draft investigation narratives while logging every step, tool call, and policy evaluation in a unified audit ledger.
These patterns all rely on controlled agent behavior plus rich audit trails that partners can interrogate.
In this first part, we established why due diligence needs controlled agentic workflows and audit-trail-first design.
In Part 2, we’ll design the technical architecture of agent audit trails identity attribution, logging layers, structured reasoning schemas and add concrete code examples that show how to capture the AI’s logic at each step.
