The moment an institution relies on a reviewer, the reviewer becomes part of the system that needs to be governed.
That is true whether the reviewer is a human expert, an independent evaluator, or another AI agent. The assurance function selects evidence, interprets ambiguity, applies a standard, and decides which findings deserve attention. Each action can be done well. Each can also drift. Giving the function a serious title does not exempt it from having an operating model.
AI makes the problem easier to miss. A team can ask one agent to produce a proposal and a second agent to review it. The reviewer agrees with the reasoning, suggests three improvements, and returns a polished assessment. The team now has two artifacts and a feeling of independent confirmation. The useful question is whether the second agent encountered evidence the first agent did not already choose.
Perhaps the proposal omitted a difficult dependency. Perhaps it framed the objective incorrectly. Perhaps the reviewer checked whether the steps were reasonable, and the steps were reasonable for the wrong purpose. Using a different model can help diversify review, but changing the logo at the top of the chat does not establish independence. Shared assumptions travel quite comfortably. They do not even need an integration.
A consequential review needs its own inputs. The reviewer should receive the governing purpose, original constraints, relevant evidence, acceptance criteria, and authority boundary. It should be possible to test a material claim without depending on the drafter’s explanation of why the claim is true. If the issue is a permission boundary, inspect the permission and the action. If it is a factual claim, follow the source. If it is an omission, the reviewer needs a way to know the omitted thing exists.
The reviewer’s standard also needs a history. Suppose a risk is first treated as a blocker. Three months later, similar evidence is routinely accepted with a note. There may be excellent reasons: stronger mitigations, better testing, a changed operating context. Record them. Otherwise an organization can redefine acceptable behavior through a series of individually plausible decisions and later discover that nobody remembers authorizing the new standard.
Anthropic’s Petri work makes a related point about automated auditors and judges: definitions and thresholds need to fit the domain, and calibration against manually reviewed transcripts matters. The authors also discuss problems with overly leading auditors and with scoring behavior accurately. That specificity is valuable because it gives the reviewing system visible failure modes. Petri’s auditing and judging design
A practical assurance design should include a deliberately varied calibration set: clear defects, acceptable work, borderline cases, and cases where the right answer depends on context. Keep some cases out of routine tuning. Ask the reviewer what evidence would change its conclusion. Examine false alarms as seriously as missed problems. A function that objects to everything trains the institution to ignore it; a function that never objects can make the institution feel wonderfully safe. Neither result proves judgment.
The most useful metric may be the disposition of objections. Was the finding substantiated, withdrawn, resolved, overridden, or left open? By whom, and on what evidence? Counts of findings show activity. Dispositions show how assurance interacts with power. If every serious objection becomes a wording adjustment before publication, the pattern matters. If every disagreement becomes a personal contest, that matters too.
The evaluator must also be able to make a mistake visibly. It should be possible to revise a finding, acknowledge an insufficient test, or admit that an interpretation went beyond the record. Independence is not a performance of certainty. It is the ability to follow evidence even when doing so is inconvenient to the evaluator’s previous position.
Assurance needs provenance, calibration, correction mechanisms, and accountable judgment. We are asking it to help govern systems that change. It should leave enough evidence for us to notice when it has changed as well.
The most dangerous rubber stamp may be the one that can explain itself.