Compliance first

In regulated domains, compliance is not a feature you add at the end. It is a property of the architecture, and architecture is very hard to change late. If you build a system in finance or healthcare and then try to bolt on an audit trail, you discover that the information you needed was never recorded, the decisions were never traceable, and the only honest fix is a rewrite. The cheap time to make a system auditable is before it exists.

“Compliance first” sounds like a tax on velocity. In practice it is the opposite. The properties a regulator asks for are the same properties that make a system debuggable and trustworthy. Designing for the auditor is designing for yourself.

What building it in actually means

Auditability comes down to being able to answer, after the fact, why did the system do this. That requires decisions to be recorded as they happen, not reconstructed later:

• Trace every decision to its evidence. InferLens ties every claim in an answer to the exact source passage. That citation trail is provenance: anyone can reconstruct why the system said what it said. The feature that makes it trustworthy to a user is the same feature that satisfies an auditor.

• Record the decision path, immutably. Axiom logs, per transaction, whether the local model or the fallback produced each extraction, and logs every inbound webhook with its status and latency. Nothing is overwritten in place. When someone asks how a number got into the books, the answer is in the log.

• Make actions idempotent and replayable. A uniqueness constraint that stops the same document from being processed twice is a correctness measure and a compliance measure at once. Deterministic, replayable processing is what lets you stand behind a result months later.

• Keep data lineage. Where a value came from, what transformed it, and which model version was active when it did. Version your models so “which weights produced this” always has an answer.

Compliance and quality are the same discipline

Notice that none of the above is really about regulation. Provenance, immutable logs, idempotency, versioned models, and recorded decision paths are just good engineering. They are also exactly how you turn silent failures into visible ones, because a system you can audit is a system whose mistakes you can find.

That is the real argument for compliance first. It is not that regulators demand it, though in these domains they do. It is that the work of making a system auditable and the work of making it correct are the same work. Do it from day one and you get both. Retrofit it and you usually get neither.