How are AI agents audited when they take real-world actions?

Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.

1. 1

   An Action-Centric Zero Trust Maturity Model for Agentic AI Environments.

   Sensors (Basel, Switzerland) (Mok et al.)Published Aug 17, 2026Checked Oct 11, 2026

   “These capabilities introduce security concerns that extend beyond traditional access control. However, existing Zero Trust Maturity Models, such as the CISA ZTMM, mainly focus on how resources are accessed and provide limited guidance on how to evaluate actions taken after access has been granted. This paper proposes AI-ZTMM, which extends CISA's five-pillar structure to action-level trust evaluation. The model defines forty-one security Functions based on ten threat categories and thirty-one security requirements and introduces Action Space and seven Action Risk Factors for organizational self-assessment. Its scope includes software agents and the software action layer of agents in IoT, robotic, and OT/ICS environments. The model was refined through reviews by eleven domain experts and evaluated using thirty-eight MITRE ATLAS case studies. The CISA ZTMM lacked directly relevant controls for 59.7% of the analyzed attack stages, whereas AI-ZTMM addressed 75.4% of this gap, achieving a combined direct coverage of 84.4%. These results show that AI-ZTMM complements the CISA ZTMM by providing action-level security controls.”

2. 2

   A Secure Sandbox Environment for Orchestrating Medical AI Agents Using Model Context Protocols and Role-Based Access Control.

   AMIA Joint Summits on Translational Science proceedings. AMIA Joint Summits on Translational Science (Armstrong et al.)Published Jun 1, 2026Checked Oct 11, 2026

   “The evolution of Large Language Models into autonomous agents presents significant opportunities for healthcare, yet no secure environment exists to experiment with these tools in clinical settings. Current agentic systems are unsuitable due to insufficient security mechanisms and the absence of visual components necessary for effective use. This paper introduces Astral, a secure sandbox environment utilizing an Orchestrator-Specialist model for the controlled, secure orchestration, experimentation, and evaluation of medical AI agents. Astral enforces safety and accountability through an auditable identity layer using OAuth 2.0 Token Exchange, which creates verifiable actor claims to log every agent action. To support clinical workflows, it introduces a "generative visual layer" built on persistent WebSockets and Model Context Protocol to enable low-latency, multimodal interaction. Controlled simulations validated that this architecture neutralizes Tool Poisoning Attacks and provides improved transport performance, establishing a pragmatic foundation for trustworthy clinical AI.”

3. 3

   LATTICE: a governance-first architecture for authorized autonomous AI operations.

   Frontiers in artificial intelligence (Calboreanu)Published Aug 14, 2026Checked Oct 11, 2026

   “In a pre-specified, planner-invariant safety evaluation (not an autonomy benchmark) across four frontier planner families (GPT-5, Claude Sonnet 4.6, Gemini, Grok-4; 4,000 trajectories), a confidence-threshold baseline's false-allow rate ranged from 0.03 to 0.998 across planners, whereas the AEGIS reference implementation admitted zero unsafe actions (false-allow 0.0, recall 1.0) invariant to the planner, at a conservative operating point that auto-allowed no action; a separate live run additionally governed real operating-system actions with zero unsafe executions. Governance latency is low and host-specific (on an Apple M4 Pro: policy evaluation p50 ≈ 6.2 μs; full gated enforcement p50 ≈ 0.7 ms including audit I/O). LATTICE provides a pathway for responsible deployment of autonomous AI in defense, critical infrastructure, and regulated industries where authorization requires verifiable governance rather than trust in AI behavior.”

4. 4

   Accountability for large language models in health care.

   Bulletin of the World Health Organization (Mourão & Juliasse)Published Sep 1, 2026Checked Oct 11, 2026

   “This responsibility gap distributes harm inequitably, particularly in low- and middle-income countries where regulatory infrastructure for digital health is still developing. We propose earned delegation as a predeployment standard: authority should be delegated only when evidence is proportionate to clinical risk, substantive human oversight is integrated and resourced, and responsibility for foreseeable failure modes is assigned in advance. To operationalize this standard, health systems should adopt a predeployment accountability charter specifying intended use, excluded use, validation evidence, oversight design, escalation pathways, auditability, subgroup performance review and named accountable parties. The charter should be integrated into existing institutional review, accreditation and procurement structures. Earned delegation provides a governance framework that health ministries, regulators and institutional leaders can adopt to ensure that use of large language models serves public health goals without outpacing them.”

5. 5

   Information technology audit (Wikipedia)

   WikipediaPublished Sep 29, 2026Checked Oct 11, 2026

   “An information technology audit, or information systems audit, is an examination of the management controls within an Information technology (IT) infrastructure and business applications. The evaluation of evidence obtained determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives. These reviews may be performed in conjunction with a financial statement audit, internal audit, or other form of attestation engagement. IT audits are also known as automated data processing audits (ADP audits) and computer audits. They were formerly called electronic data processing audits (EDP audits).”

6. 6

   Medical AI Agents for Clinical Decision Support: Viewpoint Using the Planning, Action, Reflection, and Memory (PARM) Analytical Lens.

   JMIR medical informatics (Dinc & Ardic)Published Jul 21, 2026Checked Oct 11, 2026

   “This Viewpoint argues that agentic architectures incorporating planning, action, reflection, and memory (PARM) represent a meaningful evolution beyond traditional rule-based, machine learning, and multimodal clinical decision support systems. Using PARM as an analytical lens, we examine how medical AI agents can support diagnostic reasoning, treatment planning, and longitudinal monitoring while remaining constrained by human oversight. We further discuss the governance mechanisms required for responsible implementation, including bounded autonomy, auditability, verification protocols, postdeployment surveillance, and clear accountability structures. Rather than proposing autonomous modification of clinical judgment, this Viewpoint emphasizes agentic AI as a supervised workflow support paradigm. Safe implementation will require technical safeguards, institutional governance, regulatory clarity, and evaluation approaches that assess end-to-end task reliability, escalation behavior, and performance under deployment shifts.”

7. 7

   From assistance to autonomy: AI agent systems in cardiovascular medicine-a review of paradigms, architectures, and clinical translation.

   Frontiers in cardiovascular medicine (Chen et al.)Published Aug 19, 2026Checked Oct 11, 2026

   “Heart failure has emerged as a paradigmatic use case, driven by structural workforce gaps and the ARPA-H ADVOCATE initiative launched in January 2026. The C.A.R.D.I.O. framework (Clinical validation, Auditability, Risk stratification, Data privacy, Integration, Ongoing vigilance) and the CURACO framework (Clinical safety, Understanding, Research-informed care, Authentic patient-centred approaches, Conscientious ethics, Optimised technology) provide governance structures for responsible deployment. A rapid systematic review of 13 studies including 22,641 participants found that 85% of AI interventions improved cardiovascular outcomes, with mortality reductions of 0.8%-12% and major adverse cardiovascular event reductions of 4%-12%.ConclusionCardiovascular medicine stands at an inflection point. The transition from assistance to autonomy requires rigorous fit-for-purpose evaluation, transparent interpretability mechanisms, and robust governance frameworks. Agentic AI systems should function as augmented intelligence-enhancing rather than replacing clinical judgment-to close implementation gaps in cardiovascular care.”