An agent that passes a demo and a process that survives an audit are different problems.
The second one needs the work around the model: the contracts it runs under, the traces it leaves, the point where it stops and asks a person, and the number it has to hit on your own cases before any of it counts.
That work starts with knowing the process. So we map it, bound it, then prove it.