Can Government Audit Teams Use AI Under Strict Security Rules?

By Daniel Percy, Senior Information Security Officer at DataSnipper 

Key takeaways 

• Evaluate a specific workflow, not "AI" in general. Security questions change as you move from task-based automation to connected agents.
• Ask for product-specific answers on storage, access, model training, retention, deletion, and permitted use.
• Look for review checkpoints, source links, and limits on what an agent can access.
• Ask IT and security which documents they need before you start. Stalled pilots usually trace back to unanswered questions.
  

How DataSnipper keeps AI within defined parameters

That last concern is the one I hear most from security teams, and it's the one we design around. "Working within defined parameters" should mean specific, checkable controls, not a promise. Here is what that looks like in DataSnipper. 

What the AI can do

AI runs only when a user starts it. There are no scheduled or recurring AI tasks, and nothing starts on its own. Approval points depend on the feature. Most AI features ask for human approval at key steps. Alwin works differently: once a user starts a task and approves the plan, it runs end to end without step-by-step approval, then returns results to the user for review. Excel Agents can only write to the workbook they were started in. They can read other open workbooks, but they can't create macros, run code, or remember anything between conversations. AI doesn't do the math in the Financial Statement Suite. All totals, casts and cross-checks are done by ordinary code, not AI. AI only finds and summarizes disclosure evidence. Custom agents can't loosen the rules. Agents built with Agent Builder can add instructions but can't override the built-in safety instructions, and they get no extra tools. 

Who can use it

Which AI features are enabled depends on your plan, and any of them can be disabled on request. Excel Agents can be limited to named users rather than opened to the whole organization. Turning AI off doesn't break the product. Features that don't use AI keep working. 

Where it runs

Each Alwin task is sealed off. It runs in its own sandbox with no internet access and no access to any other task's data. The AI can't reach the internet. Its only outbound calls go to the model services that power it: Microsoft Azure Foundry and Google Vertex AI, plus the OpenAI API for UpLink and DocuMine. 

What's on record and tested

Alwin logs its actions in the task interface, so a reviewer can see what the agent did, not just what it produced. Every AI feature is tested before release. Each one is risk-assessed against the OWASP Top 10 for LLM and Agentic AI, approved by our Security Board, and penetration tested at least once a year. 

Match the security review to the maturity stage

1. Task-based automation covers rules-based work: tick and tie, document matching, and data extraction.
2. AI-assisted automation adds document review, intelligent search, and extraction that keeps the evidence attached. In both stages, an auditor starts every task, and the work usually stays in an environment your team can govern. 
3. Agentic automation is goal-driven. Instead of running one task, an agent runs a multistep, often recurring procedure across several documents.
4. Connected agents coordinate with each other across systems. From stage three on, the review has to cover what each agent can reach, what it can change, and who answers for the result. 

Ryon Williams, Sales Director at Carahsoft said most teams sit in stage one (just starting out), with some moving into stage two. The jump to stages three and four (more advanced) takes a governance model at the agency level. 

"We can look at this as taking bites out of the apple instead of trying to bite that whole apple at once," says Kristopher Knight, Director at Microsoft. 

That advice shapes the first step. Describe the procedure you're considering: 

• What work would the tool perform?
• Which documents would it use?
• Which systems would it access?
• What would an auditor approve or review?
  

Those answers give IT and security something specific to approve, question, or decline. A general request to "use AI" gives them nothing to evaluate. Luis Mejia, a Solutions Engineer at DataSnipper advice on pacing: don't skip stages, because each one builds the trust, data quality, and review habits the next one depends on. 

Get product-specific answers about data handling 

Government audit work runs on contracts, payroll records, grant documentation, and other information with handling restrictions. A taxing agency, for example, may hold IRS-governed data that is not allowed to leave the agency at all. 

• Storage and processing: Where does each take place?
• Access: Which users and providers can access the information?
• Model training: Are inputs or outputs used to train models?
• Retention: How long are documents and results kept?
• Deletion: How can information be removed?
• Permitted use: Do the product's terms allow the proposed data and activity?
  

Here is where DataSnipper stands on each. 

• Model training. DataSnipper does not train models on customer data. 
• Encryption. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. 
• Retention and deletion. An answer for one feature doesn’t carry over to every product from the same vendor, so our security documentation describes data handling feature by feature. DocuMine stores input for up to 24 hours. Advanced Document Extraction deletes processed documents within 24 hours. 
• Sensitive data. For every AI feature except Alwin, DataSnipper recommends that customers do not process sensitive personal data as defined in Article 9 of the GDPR. For more information, see our Data Processing Agreement. 
• Location and backups. Primary hosting is available in US, EU, and Australian data centers. Two details matter for government customers: 
• For Australian deployments, AI inference still takes place in the EU.
• Task data is backed up for seven days, and those backups are stored exclusively in the EU. They are not region-locked to the primary hosting region.
• Infrastructure and subprocessors. The AI features run on a combination of Microsoft Azure’s Foundry and Google Cloud Platform’s Vertex AI. Some features, UpLink and DocuMine, still call the OpenAI API directly. Your IT team should see the full list of providers behind the features you plan to use. 
• Agent scope. Agentic features run in isolated sandboxes with no internet access. Excel Agents can be limited to a list of named users. In the demo, Luis noted that Excel Agents don’t access additional workbooks unless they’re open. 

Show where human review happens

Review is where an audit team keeps control of an agent's work, so it's worth knowing exactly where the checkpoints sit. The webinar demo showed four. 

1. Ownership. A task gets a named owner and the documents it needs, such as a reconciliation template and supporting files. In the webinar, Luis assigned the task to himself as reviewer.
2. Planning mode. Before the agent runs anything, it reviews the uploaded files and proposes a plan. In a consolidation review with 40 files, the reviewer could approve the plan or add an instruction.
3. Review. When the agent finishes, the task returns to the owner marked "needs review," with its findings and anomalies listed.
4. Source checks. Clicking a cell opens the agreement, spreadsheet, or FX rate behind the number, so the reviewer can follow the chain without taking the agent's word for it.

Luis reinforced this during the demo that, "Not everything is about speed, but also about control." 

Agent identity is the other half of control. In the Microsoft and DataSnipper whitepaper, Closing the Verification Gap, Robert Eichenseer of Microsoft explains that each agent has its own ID and is monitored the way a human user is. An agent can act on behalf of a person or hold its own identity, and its cost and effectiveness are tracked. 

One takeaway that I loved from Kris was "Agents only have the authority that we give them. Think of them just as people in your shop."  

Human review covers the quality and accountability of the procedure. Hosting, privacy, and security requirements need their own evidence. 

Give IT and security evidence they can review

From the security side, a vendor’s claims matter only as far as I can verify them. When a pilot request reaches my desk, I want to know what data goes where, who can touch it, what the tool can do on its own, and which documents prove it. 

Closing the Verification Gap notes that stalled government pilots usually don’t come from opposition. IT often has security questions nobody has answered yet, or too much on its plate. Knight says Microsoft is sometimes the one feeding IT teams the information they need to get past that hurdle. Engaging early, with the questions answered and the business case stated, is what gets pilots moving. 

DataSnipper’s security page lists the materials available for review: 

• Data Processing Agreement
• Data-flow diagram
• Security release documentation
• SOC 2 report
• Penetration-test reports

Some are confidential and carry access conditions. 

Ask IT and security which documents they need for your proposed use. They may want the data flow, the access controls, the contractual terms, or the scope of an independent assessment. A SOC 2 report or similar certification supports that review. It doesn’t approve every agency, data type, or workflow on its own. 

Check scope, traceability, infrastructure, and governance

Kris closed his section of the webinar with four requirements for an agentic audit: scope, traceability, infrastructure, and governance. They work as a checklist for your proposal. They also apply to the agencies you audit, because you can't conduct the audit you need without a baseline understanding of how an auditee uses AI. 

So pick a procedure your team knows well. Document the information it uses, the actions the tool would perform, and the review steps that stay with an auditor. Then work with IT, security, and other stakeholders on whether the use is acceptable and what evidence is still missing.