Skills + Policy Audit

Skills + Policy Framework Audit

This page separates what agents can do from what they are allowed to do. Skills are enterprise capabilities; policies are enterprise guardrails. Every governed decision must prove the skill, authority, policy version, evidence gate, replay path, and human override boundary.

Skills Framework

Skills define enterprise capabilities: match invoice, validate journal, explain variance, recommend accrual, assess credit, or optimize payment timing. A skill is not an autonomous right to act; it is a governed capability contract.

Purpose	Business outcome the skill supports
Inputs	Data, documents, events, and context required
Outputs	Recommendations or actions produced
Authority	Read-only, recommend, approve, or execute
Evidence	Proof required before recommendation or execution
Explainability	Reasoning and source context available
Replay	Execution can be reconstructed later
Learning	Outcome feedback can improve future recommendations
Human override	Human authority boundary remains explicit

Purpose

Business outcome the skill supports

Inputs

Data, documents, events, and context required

Outputs

Recommendations or actions produced

Authority

Read-only, recommend, approve, or execute

Evidence

Proof required before recommendation or execution

Explainability

Reasoning and source context available

Replay

Execution can be reconstructed later

Learning

Outcome feedback can improve future recommendations

Human override

Human authority boundary remains explicit

Policy Framework

Policies define enterprise guardrails: approval limits, segregation of duties, payment thresholds, materiality rules, control requirements, and exception handling.

Source	Policy Runtime / authority matrix
Owner	Finance Governance
Scope	Process, domain, case type, and entity
Enforcement	Advisory or mandatory
Versioning	Historical versions replayable
Exceptions	Approved through human governance
Evidence requirement	Proof required by policy
Monitoring	Compliance measured through ledger and replay
Auditability	Every decision traces to policy

Source

Policy Runtime / authority matrix

Owner

Finance Governance

Scope

Process, domain, case type, and entity

Enforcement

Advisory or mandatory

Versioning

Historical versions replayable

Exceptions

Approved through human governance

Evidence requirement

Proof required by policy

Monitoring

Compliance measured through ledger and replay

Auditability

Every decision traces to policy

Live Skills + Policy Runtime Proof

Live runtime

Skills audited

Authorized

Review required

Not authorized

Skill	Case	Authority	Policy	Status	Explainable	Replay
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	sphere:finance:invoice:INV-00914 invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	sphere:upstream:well:WELL-104 well	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	sphere:trading:trade:T-8821 trade	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	sphere:finance:invoice:INV-00914 invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	sphere:finance:invoice:INV-00914 invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing
Hold Duplicate Payment SKILL-P2P-DUP-HOLD	INV-UDP-CERT-001 Invoice	recommend + controlled execute governed action	Policy missing vversion missing	not authorized	Review	Missing

Runtime relationship

Agents do not execute because they are intelligent. They execute only when an enterprise skill is authorized by policy, supported by evidence, and governed through replay and accountability.

Context

Skill Activated: Hold Duplicate Payment (SKILL-P2P-DUP-HOLD)

Policy Evaluation: Policy missing

Evidence Collection

Decision Recommendation: No governed action linked

Human / Agent Action

Replay & Audit

Learning

Selected skill proof

Skill owner	P2P Control Owner
Risk class	High financial control
Evidence gate	Invoice, Purchase order, Receipt, Prior payment
Systems impacted	SAP payment block, Supplier validation workflow, Evidence ledger
Human override	Available

Core workshop message

Agents do not execute because they are intelligent. Agents execute because a skill is authorized by policy, supported by evidence, and governed through replay and accountability.