AI is used by the powerful to oversee the masses. We should instead be using it to let the masses oversee the powerful.

Imagine anyone can submit natural language queries about any sufficiently large institution. To do so, you pay some money, specify an AI auditor, and the instructions/scaffolding. Examples:

  • Claude Fable 7.5 auditing Goldman Sachs: “Flag anything inconsistent with the risk-committee independence required under Dodd-Frank §165.”
  • DeepSeek v7 auditing the Pentagon under expanded FOIA: “Is the Pentagon’s command and control logic willing to automatically target foreign civilians and under what tradeoffs if so?”
  • GPT-8.1 auditing Anthropic: “What are ways Anthropic might be training their models to have secret/unexpected loyalties?”

The auditor model is given tools that provide comprehensive access to the institution’s audit trail. It is important that the audit trail is maximally complete, with all internal documents, communications, AI agent traces, etc. As firms become increasingly driven by AI output, the AI agent traces dominate. For humans (that still have jobs), this is a bit more invasive than the constant possibility of subpoena, but ultimately minimally affects the work lives of honest employees. The audit trail is kept in a tamper-evident append-only log; hashes of all documents are published continuously and publicly.

A third party institution is responsible for maintaining the auditing infrastructure, and is entrusted with the simple responsibilities of maintaining the logging software, securely accessing the auditor model weights, and running the query in some trusted execution environment. Unlike a traditional human auditor, the auditor model ceases to exist after the audit, and the auditee has no fear of information leakage. The audit results then undergo a redaction process and are then scheduled to publish publicly. The third party is quite trusted: 1) their role is mechanical and requires minimal judgement, 2) they are paid by people interested in accountability, rather than by institutions, unlike the traditional auditing regime, and 3) it is subject to its own audits, perhaps by a rival third party. There are no direct consequences of audit results, in general. But depending on the circumstantial evidence, someone might decide to sue the institution, and documents will then be surfaced in discovery.

How does the redaction process work? By default, institutions cannot withhold anything from results. But there are categories of exemptions, established by law and democratic process: customer PII, weapons access, trade secrets, etc. Each institution has to then apply for and publish specific exemptions, like “My company is going to develop new proprietary training algorithms for neural networks”. This is unfortunately ripe for lawfare. To mitigate, exemptions are only valid for a period of time, e.g. trade secret exemptions often cannot be used for documents from >10 years ago. And all exemptions are made public. After an auditor model produces a response, the auditee can flag sections for redactions (typically done with a standardized redactor model), citing the corresponding exemptions that they have already applied for. If the auditor model disagrees with the redactions, this is noted, but the redaction still goes through. Existence of redactions and disagreements are public. Too many disagreements on redactions also leads to lawsuits, where everything becomes unsealed (though subject to protective orders). The threat of eventual discovery makes disagreements on redactions rare, for legitimate auditor models.

What about public trust in the auditor model? This comes from auditing the developer of the auditor AI. Say Claude Fable 7.5 is commonly used for auditing. We use GPT-7 or an open source model to make sure Anthropic’s alignment process of Claude Fable 7.5 was conducive to producing honest models trying their best to audit in all circumstances. This relies on good science for alignment auditing. Also, at some point, we had to bootstrap the trust from traditional auditors, who made sure the first auditor model was aligned enough and that Anthropic had sufficiently complete logs. As with self-compiling languages, this first step is critical to get right, and it has to happen early on (which means ASAP, in my opinion).

Checks and balances at a governance level are easier than before. Investigative journalists get instant responses to their FOIA requests, though classified information is exempted. Congress gets access to queries that invalidate all exemptions, and constantly ask auditors about cases of potential executive overreach. Governments constantly query the relevant institutions to make sure international treaties are enforced, when in the past cooperation would’ve failed for lack of credible mutual verification. For example, the AI pause treaty consists of things like “Are the satellites still tracking all new data-center creation?” and “Are any companies in charge of big data-centers running training runs with X flops?”. In some high stakes scenarios, there are queries that the governments pay to maintain constantly and run in real-time. In this modified system, the result of audits can block agent actions and alert relevant authorities.

Institutions of course sometimes attempt to avoid the audit trail. To prevent this, all logged AI agent activity is required to be stored alongside provenance, tracing back to either a human being, another agent, or a piece of software. The third party facilitates programmatic checks that all activity originates from something else in the audit trail, or from some human directive. If a large amount of activity is claimed to originate directly from a human, this is quickly flagged as suspicious, since humans cannot operate at such scale. There are also inter-institutional cross-checks for consistency – for any activity that affects the external world, anyone can query to find the corresponding record. Taken together, attempts to hide large amounts of activity outside the trail is difficult: any action which eventually leads to affecting the world can be traced back to that action.

Sometimes, people try to develop jailbreaks for the auditor model. This usually is noticed immediately, but in some cases is discovered 1-2 generations of auditor models later, and is always punished under criminal law. Academics also worry about steganographic encodings that the auditor model can’t understand. Discussions of those developments would need to happen outside of the audit trail, and it seems very difficult in practice. It is also illegal to use language models that were not trained in audited settings; the law was established after the NSA started using a model an employee trained in their personal time. Overall, ability to thwart the system in practice seems quite limited.

More problematic are the powerful institutions weaponizing exemption, auditing opponents, and trying to set the rules differently for themselves. This is a constant political battle, but one which slowly converges towards an equilibrium that is able to prevent major violations of public interest. In some cases, this is because large scale harms are ultimately visible (even if initiated by machinations that aren’t), and in other cases it is because of whistleblowing. The good equilibrium is also self-stabilizing: people use audits to make sure the system itself is not weaponized.

The more difficult line to draw is which entities are subject to mandatory audit. The same technologies applied to small firms or individuals is considered a significant encroachment on liberalism. At the same time, even small groups are occasionally capable of large harms, and the tradeoffs here are difficult and contested. Furthermore, some large entities argue they are less capable of coercive power than others with equal size or fiscal resources. Over time, as people become more comfortable with the auditing infrastructure, the threshold gets lowered – incidentally, this becomes less of an issue as AI agents who don’t mind being audited become responsible for more of the economy.

The end result is that all the important functions of society are structurally transparent, and accountable to serve only the functions they are meant to. It is known exactly what firms are competing on, what dangerous information governments or certain institutions are entrusted with, etc. Everyone has the right to know everything about what is happening, except what they have agreed to withhold. Humans can ask questions and get sensible answers. And there is much more trust to go around.

A political call to action: This world is only possible with sufficient political will. Historically, this often only follows acute crises, like the exposition of Operation CHAOS leading to the Church Committee reforms, or the 2008 financial crisis leading to Dodd-Frank. In both cases, our public attention faded and other concentrated interests weakened the oversight (the Patriot Act, rollbacks of Dodd-Frank), enabling the next round of crises (NSA bulk metadata programs, the SVB collapse). We need to call for much better defaults, and stay vigilant at resisting weakened oversight.

A technical call to action: If you’re interested in helping build pieces of this, contact me!