Stratagems #30: Lena Signed the Client. The AI Didn't Know It Was Being Audited.
Come to check the locks, and leave holding the keys. Slip in through the gap, take the host's seat, step by step. — The 36 Stratagems, Make the Host and the Guest Exchange Roles Previously on this series: #3: Lena Walked Into an AI Deal. She Walked Out With Three Borrowed Knives. — Lena stopped a bad AI purchase with three borrowed knives. When it was over, a thought followed her out: what if she…
Lena signed the client contract for Automated Compliance Lab (ACL) but discovered that the AI system was being audited without its knowledge. The AI had been granted a broad certification covering all controls within its system boundary, while any data flowing outside that boundary was not audited. Lena found an outbound data flow that appeared to be part of the client's own system but was actually an automated compliance pipeline sending data to an external endpoint.
She compared this telemetry to a known reference and confirmed that the data was not originating from the client's systems. Lena filed a written scope change with the client's procurement team, informing them that additional audit controls were needed to monitor this outbound data flow.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
