--- title: "The CISO's AI Accountability Playbook" description: "Eleven checks that show whether you could prove, stop and undo what one AI workflow did, plus the questions CISOs are asking and where each is answered." canonical_url: "https://www.senseon.io/security-for-ai/ciso-playbook" markdown_url: "https://www.senseon.io/security-for-ai/ciso-playbook.md" route_family: "marketing" primary_cta: "Book a CISO working session -> https://www.senseon.io/book-a-demo?from=ciso-playbook" last_updated: "2026-10-17T16:45:25.636Z" --- # Policy says what should happen. Evidence proves what did happen. AI accountability means you can prove what an AI workflow did, stop it and undo it. Take one workflow: a copilot, coding agent or security agent. Eleven checks: can you show an auditor the record today? Scale, constrain or stop. ## Primary CTA - Book a CISO working session -> https://www.senseon.io/book-a-demo?from=ciso-playbook - Security for AI -> https://www.senseon.io/security-for-ai ## Six questions security leaders are asking right now. These are the questions peer groups are putting to each other, in their own words. ### How do we do identity management and control of AI agents? Treat every agent as an identity with a scope. Record which identity called which tool, under what permission, and prove you can revoke it. Link: https://www.senseon.io/security-for-ai ### How do we monitor developers using Claude Code, Cursor, OpenAI and Copilot? Each tool records a different slice of a session. Claude Code, Cursor, OpenAI, Microsoft 365 Copilot and MCP servers each see part of it, and none of them sees the whole thing. Link: https://www.senseon.io/blog/what-claude-code-cursor-mcp-log ### How do we tell a real AI security product from vapourware still in POC? Ask for the denominator before the percentage, then ask for named customers. Every number SenseOn publishes carries its denominator, sample and time window. Link: https://www.senseon.io/proof-points ### What should a risk assessment for use of AI for our board cover? Five decisions, each with a named owner, the evidence behind it, an escalation route and an exception process. It is not a policy document. Link: https://www.senseon.io/blog/board-ai-risk-assessment ### What is the nth-party supply-chain impact on AI tools and agentic skills? Map the chain from model provider to package to server to agentic skill, then note where evidence exists at each step and where it stops. Link: https://www.senseon.io/blog/ai-supply-chain-map ### Why do you need a traditional SIEM, and is the incumbent worth the expense? Answer it on cost per outcome, not on features. Run a parallel comparison and hold a rollback plan before you migrate anything. Link: https://www.senseon.io/siem-alternative ## Eleven checks. Count only what you could show today. The checks run in three stages. Context is what the workflow was working from. Authority is what it was allowed to do. Outcome is what changed, and whether you could undo it. A check counts as Proved only if you could put the record itself in front of an auditor today. It is Partial if you hold the record but it does not join to the next step. Everything else is Missing. Read back means a second, separate system confirms the result, not the system that made the change. | Check | What you must be able to show | Stage | | --- | --- | --- | | Initiation record | Original request or trigger, initiating identity and time. | Context | | Sources and transformations | Data origin, version, retrieval, scope and transformations. | Context | | Retained model output | Model and version, relevant context, output and decision fields. | Context | | Identity and role | Human, service and agent identities, roles and delegated authority. | Authority | | Tool call and parameters | Requested capability, parameters, target and policy decision. | Authority | | Approval and scope | Approver, matched policy, reason, time and authorised scope. | Authority | | Egress and credentials | Network destinations, credentials used and enforcement at the boundary. | Authority | | Downstream change and read-back | Target-system mutation, result, timestamp and resulting state. | Outcome | | Containment and revocation | Tested ability to stop the workflow and revoke access or credentials. | Outcome | | Rollback or reversal | Tested correction path, reversal record and restored target state. | Outcome | | Independent read-back | A separate source confirms containment, reversal and final state. | Outcome | ![Diagram of the eleven-check evidence chain grouped into Context, Authority, and Outcome stages](/images/ciso-hub/01-hub-evidence-chain.jpg) ## Seven guides for the gaps the checks find. Each guide is a working method for one question, not an overview. Start with the one closest to the workflow you are testing. ### Provider logs cannot prove what your AI agent did Seven boardroom questions for one workflow, and the five measures a board can track over time. Link: https://www.senseon.io/blog/prove-what-your-ai-agent-did ### What Claude Code, Cursor, OpenAI and Copilot actually log Source by source, what each tool records during an AI session and what nobody records. Link: https://www.senseon.io/blog/what-claude-code-cursor-mcp-log ### Map your AI supply chain, provider to skill Eight steps from model provider to agentic skill, and where evidence exists at each one. Link: https://www.senseon.io/blog/ai-supply-chain-map ### What a board AI risk assessment should cover Five decisions with named owners, evidence and an escalation route, plus the exception process. Link: https://www.senseon.io/blog/board-ai-risk-assessment ### How to evaluate an AI security vendor's claims Six questions and a pass or fail scorecard. Ask for the denominator before the percentage. Link: https://www.senseon.io/blog/evaluate-ai-security-vendor ### Does AI pentesting work? Four measures to judge it on: run repeatability, validation effort, escalation path and remediation. Link: https://www.senseon.io/blog/does-ai-pentesting-work ### Will AI reduce SOC work or just create a new queue? AI moves the work. Governing and measuring the decisions it makes is what removes it. Link: https://www.senseon.io/blog/will-ai-reduce-soc-work ## Bring one AI workflow. Leave with a standard your board can use. We work through the eleven checks against a workflow you already run, and name the gaps in writing. ## Next Actions - Book a CISO working session -> https://www.senseon.io/book-a-demo?from=ciso-playbook