The agent that acts is not the agent that certifies

Graph Engineering pattern 13 of 15: the Evidence & Compliance Graph. Evidence emitted on the edge, an auditor that reads the store directly, a human signature — separation of duties as a property of structure.

The agent performing an action should not be the agent certifying that its own action was correct. In regulated work, how an outcome was reached is part of the outcome — and this graph makes that a property of structure rather than a hope about behavior.

Context for new readers: pattern 13 of 15 in the Graph Engineering series. Like the release pipeline (pattern 9), this is a governance-shaped graph: its value lives as much in the edges it forbids as in the ones it draws.

The problem

Work must be performed and be demonstrable — to a regulator, an auditor, a customer, an internal risk function — that it followed the mandated process, with evidence, and that the parties who verified it were independent of the parties who did it. A trail reconstructed after the fact is a memoir, not a record.

The topology

  Workers
     |          evidence emitted
  Evidence Collector ----> [Evidence Store]
     |                          ^
  Compliance Reviewer           | reads directly
     |                          |
  Independent Auditor ----------+
     |
  Human Approval

Workers execute, and every consequential action emits artifacts — what was done, on whose instruction, with what result — to an evidence collector that files them in an evidence store, in-line with the work. A compliance reviewer checks the work against the mandated process: required steps, in order, with required sign-offs. An independent auditor — independent meaning no incoming edge from the execution side — examines both the work and the trail itself, reading the store directly rather than accepting anyone's summaries. A human approver signs, because regulation ultimately requires accountability to attach to a person. The chain is strictly ordered; no skipping edge exists.

Each separation answers an audit question

• Worker ≠ collector: execution cannot curate its own record.
• Reviewer ≠ auditor: process compliance and record integrity are different examinations.
• Machine ≠ human at the top: sign-off is a human act.

The graph's history — which node did what, in what order, with what evidence — is itself the compliance artifact. That is why evidence is emitted on the edge as the work happens; organizations discover the cost difference between recorded-in-line and reconstructed-afterward during their first audit.

Where it breaks

• Evidence as afterthought. Finish first, document later — a memoir.
• Auditor reads summaries. That audits the collector's prose, not the record. The direct-read edge to the store is the pattern's whole point.
• Approval fatigue. A human approving four hundred items a day approves nothing. Tier the approvals: routine outcomes batch under sampling; consequential outcomes get individual attention — encoded in the graph, not left to the human's triage.

The dimension answers

Where rysh fits

The human-authority edge at the top of this graph needs enforcement in code, not prompts. In rysh, on Slack, email and WhatsApp, you flip the channel to human and nothing posts until a person types send — enforced at the send tool. Whatever the prompt says, the agent structurally cannot bypass the person.

Honest scope

• The gate above is three named channels — Slack, email, WhatsApp — not a property of every channel.
• The compliance graph itself is an organizational design you build; rysh ships the gates, panes and policy primitives it runs on.
• rysh is open-core: the CLI is Apache-2.0, the server is proprietary. It runs on Claude, with your own key.

Next: pattern 14, the Autonomous Operations Loop — the graph with no done state.

Building this with design partners → rysh.ai/design-partner