A governance framework answers the question "what is allowed?" An auditor asks a different one: "what happened?" Between those two sits a question most companies can't answer at all: where does the data actually flow?
Policies exist. Classifications exist. The data-flow diagram from the last audit exists (already outdated when it was presented). What's usually missing is the ability to take one customer record and say with confidence: these systems hold it, these processes touched it, this left the network, this was shown to a model. Not as a research project; as a lookup.
Two observations from the audit-heavy projects we've been part of:
- why nobody can draw the map
- what changes when the map draws itself
Why nobody can draw the map
The honest reason: execution is scattered. Data in a normal company moves through:
- SaaS-to-SaaS syncs configured in vendor admin panels
- a Zapier account from 2022, still owned by someone who left
- scripts on a VM, running under a service account
- inbox rules, BI extracts
- and the largest channel by volume: people copying values between screens
Each of these moves data. Almost none of them records that it did, in any form an auditor could read.
So tracing becomes archaeology. Every audit, every data-subject request, every incident starts the same expedition: interview the tool owners, dig through the integrations, hope the person who built the middle step still works here. The map gets redrawn by hand, stays roughly right for a month, and decays until the next expedition.
The governance team ends up in an impossible position: accountable for flows it can neither see nor list. No amount of policy writing fixes an observability problem.
Tracing as a property, not a project
The situation changes when processes run through one execution layer instead of forty channels. Not because anything becomes "more compliant" by itself, but because a single layer can do what forty channels never will: record every step as a side effect of running it.
The properties that matter, in plain terms:
- every step logs what went in and what came out, not just "the flow ran"
- who or what triggered it, under which permission
- every value knows which step produced it and which system it came from
- the log itself has retention rules and can't be quietly edited
- sensitive fields can be masked, so the audit trail doesn't become the leak
With that in place, the questions that used to trigger expeditions become queries. Which processes touched this customer in the last year? What exactly left our network in June? Who approved the step that posted this entry? The trace stays current because the execution itself produces it. A map drawn beside the territory drifts; one generated by the territory doesn't.
This is, more or less, the compliance argument for the whole execution-layer category. flow8 is one example built with the audit log as the primary artifact rather than an afterthought (and self-hosted, which answers the awkward first question of where the trace itself lives).
The regulators are heading the same way
The direction of travel is consistently records over policies. GDPR already requires records of processing activities, and every data-subject request is, in practice, a tracing exercise. The EU AI Act leans on logging and traceability for high-risk use: not assurances that the model behaves, but records of what it did. FINMA expects demonstrated control over where data goes, subprocessors included. The pattern across all of them: "show me the record" is replacing "show me the policy".
AI raises the stakes on the same axis. Once models participate in processes, the trace has to answer new questions: which model saw which fields, what was masked before the call, what came back, what the process did with it. An AI step that isn't logged like any other step is an untraceable data flow to a third party, which is exactly what all of these frameworks exist to prevent.
A quick self-check
Skip the maturity assessment. Take one customer, one supplier, one employee record, and ask for the full trace: every system, every process, everything that left the network, past twelve months. Time the answer.
Minutes means the governance is real. A working group means the gap between the policy binder and the actual company is the size of that group's calendar. We've run this exercise with clients a few times now. Happy to share how we structure it, if useful!