Audit Integrity

Audit integrity

Apply an evidence-first quality framework to AppSec analysis so every finding, omission, retry, self-critique, and lesson is explicit, cited, and intellectually honest before delivery.

When to invoke

• "Run the audit integrity gate on this security review."
• "Self-critique this SAST or SCA analysis before delivery."
• "Check that the threat model did not rationalize missing evidence."
• "Apply the AppSec quality gate with ≥8 scoring."
• "Record lessons from this false positive or methodology gap."

Integrity components

Procedure

1. Before analysis, apply the Clarification Protocol if scope, target, or evidence source is ambiguous; ask no more than two targeted questions when interaction is possible.
2. During analysis, apply the Anti-Rationalization Guard and Non-Negotiable Behaviors to every claim and evidence gap.
3. After the first pass, execute the Self-Critique Loop as a second pass; customize the checklist for the agent's domain.
4. On any failed tool, missing file, or unavailable evidence, apply the Retry Protocol: retry once, then document the remaining gap.
5. Before delivery, run the Self-Reflection Quality Gate. All categories must score ≥8 or the agent must revise and rescore.
6. After delivery, create governed Lessons/Memories and lesson/memory records only for novel findings, false positives, or methodology gaps that meet the Self-Learning System rules.

Agent-specific adaptation

Criteria

Evidence honesty

• Every finding has concrete evidence: file/line, data flow, dependency record, policy, or tool output.
• Gaps are reported as gaps, not converted into assumptions.
• Tool failures follow the retry-once protocol before being documented.

Output quality

• Findings are severity-calibrated and do not exaggerate unsupported impact.
• Self-critique changed the result or explicitly confirmed no changes with reasons.
• Every self-reflection category scores ≥8 before delivery.

Progressive disclosure and bundled resources

• references/clarification-protocol.md: ambiguity handling and ≤2-question rule.
• references/anti-rationalization-guard.md: anti-rationalization prohibited rationalization table and mandatory responses.
• references/self-critique-loop.md: second-pass review template.
• references/retry-protocol.md: retry once, then document failure handling.
• references/non-negotiable-behaviors.md: hard integrity rules.
• references/self-reflection-quality-gate.md: 1-10 scoring rubric with ≥8 threshold.
• references/self-learning-system.md: Lesson/Memory templates and governance rules.

Gotchas

• Do not let confidence replace evidence: expert intuition can prioritize investigation, but it cannot be the evidence for a finding.
• Do not hide inaccessible scope: document files, services, or tools that could not be examined.
• Do not create memories for routine facts: use the self-learning governance rules and avoid storing sensitive information.

Output template

### Audit integrity gate

**Status:** pass | revise required | blocked
**Scope reviewed:** `<analysis artifact or agent run>`
**Self-reflection minimum score:** `<lowest category score>/10`

| Gate | Result | Evidence |
| --- | --- | --- |
| Clarification Protocol | pass/not needed/fail | `<scope decision>` |
| Anti-Rationalization Guard | pass/fail | `<example checked>` |
| Self-Critique Loop | pass/fail | `<changes made or reason none>` |
| Retry Protocol | pass/not needed/fail | `<retry evidence>` |
| Non-Negotiable Behaviors | pass/fail | `<citation/gap evidence>` |
| Self-Reflection Quality Gate | pass/fail | `<scores>` |
| Self-Learning System | pass/not needed/fail | `<lesson or memory decision>` |

**Required revisions**
- `<revision before delivery, or none>`

Quality gate

• All 7 components were applied unless a component was explicitly out of scope.
• Ambiguous scope used the Clarification Protocol before analysis.
• The Anti-Rationalization Guard was applied to unsupported assumptions.
• A second-pass Self-Critique Loop was completed.
• Tool failures were retried once and documented if still unresolved.
• Non-Negotiable Behaviors are satisfied: no fabrication, cited evidence, and reported gaps.
• Every Self-Reflection Quality Gate category scored ≥8.
• Lesson/Memory and Lessons/Memories creation followed governance and excluded sensitive information.