AI Committee Quarterly Review: Runtime Evidence for Production AI Systems and Agents
A health system AI committee should request a fixed quarterly package of runtime evidence in six categories: policy enforcement outcomes, tool-call and MCP activity, agent identity and permission changes, sensitive data access, exceptions and overrides, and audit log completeness. Each category answers one control question. Together they let the committee verify that approved controls are operating and compare results from one quarter to the next.
Treat the meeting as a control-verification checkpoint
Rather than reviewing a general status update, the committee requests a fixed package of runtime evidence each quarter. The package lets the committee verify that approved controls are operating on production AI systems and agents.
The package is organized into six evidence categories, each tied to one control question.
The six evidence categories
The table below lists the quarterly runtime evidence package and what each category shows the committee.
| # | Evidence category | What it shows |
|---|---|---|
| 01 | Policy enforcement outcomes | Allowed, blocked, and escalated decisions |
| 02 | Tool-call and MCP activity | What each agent actually invoked |
| 03 | Identity and permissions | Changes against approved scope |
| 04 | Sensitive data access | PHI access by agent and use case |
| 05 | Exceptions and overrides | Who bypassed a control, and why |
| 06 | Audit log completeness | Whether the record can be trusted |
Structure the review so quarters are comparable
Request the same six categories every quarter. A fixed package lets the committee compare results from one quarter to the next, rather than evaluating each quarter's evidence in isolation.
What makes a runtime record auditable, and how to read it
The sixth category, audit log completeness, shows whether the record can be trusted. The other five categories depend on it: policy decisions, tool calls, permission changes, data access, and overrides are only useful as evidence if the record behind them is complete.
The gaps listed in the next section show where a record cannot support that kind of review.
Evidence gaps that signal a capability problem
Define the evidence your committee can verify
Talk to an expert about producing runtime policy enforcement, agent identity, tool-call, and audit log evidence for your quarterly AI committee review.
Talk to an Expert