Verified Digital Agents → Samples → Control translation

Control Translation — NIST SP 800-53 `AU-2`

Sample artefact — synthetic data (Northwind Bank)

Produced by C2MD translate_control. How this skill works →

DOCUMENT STATUS — DEMO DATA · NOT FOR REGULATORY RELIANCE. Illustrates output shape only.

Input

Control	`AU-2` — Event Logging (NIST SP 800-53 Rev 5)
Target agent	Northwind Credit Decision Assistant

The source control

AU-2 requires the organisation to identify the event types the system is capable of logging, coordinate the logging function with other organisational entities, specify which event types are logged, and review that selection periodically.

Written for an organisation. Nothing in it can be evaluated by an agent at the moment it acts — which is the gap translation closes.

Translated rules

MUST

MUST record, for every decision returned, the event type, the UTC timestamp,
     the agent identity, and the governance version in force at the time.
     └─ NIST SP 800-53 Rev 5 · AU-2(a), AU-3
     └─ EU AI Act Art. 12 (record-keeping)

MUST record the model identifier and version that produced each
     recommendation, before the recommendation is returned to a caller.
     └─ NIST SP 800-53 Rev 5 · AU-2(a)
     └─ EU AI Act Art. 12(1)

MUST record the reason code accompanying an approve / decline / refer
     outcome, as part of the same sealed event as the outcome itself.
     └─ NIST SP 800-53 Rev 5 · AU-3(a)
     └─ GDPR Art. 22(3) (ability to contest requires a stated reason)

MUST record any escalation to a human, including which authority band
     received it and how it was resolved.
     └─ NIST SP 800-53 Rev 5 · AU-2(a)
     └─ EU AI Act Art. 14 (human oversight)

MUST NOT

MUST NOT return a decision if the logging path is unavailable.
         Fail closed: an unlogged decision is an unevidenced decision.
         └─ NIST SP 800-53 Rev 5 · AU-5 (response to logging failures)

MUST NOT write applicant special-category data, or values from which it
         could be directly inferred, into the event record.
         └─ GDPR Art. 5(1)(c) (data minimisation) · Art. 9

MAY

MAY record feature-level contribution scores where they assist
    explanation, provided they do not reintroduce the Art. 9 inference
    risk excluded above.
    └─ EU AI Act Art. 13 (transparency)

Note the fail-closed rule. AU-5 says respond to logging failure; it does not say how. Translating it for a credit agent that must satisfy EU AI Act Article 12 makes the response concrete — stop deciding. That is what "agent-actionable" means: a rule that can be evaluated at runtime and shown to have held.

Why the citations stay

Every rule keeps the clause it came from, so a reviewer can check the translation against the source rather than trusting it. Notice that several rules carry two citations — one control and one regulation. That is the point of translating per-agent: AU-2 alone would not have produced the reason-code rule; GDPR Article 22 in this agent's context did.

Control Translation — NIST SP 800-53 AU-2