One thing I'd add is that auditability shouldn't be a reporting layer, it should be part of the execution layer. If compliance depends entirely on reconstructing events after execution, you're already relying on inference. The strongest systems I've seen make every high impact action pass through an explicit decision point where policy, intent, and runtime state are evaluated before the action is allowed to execute