When the engineer is an AI agent, who approved its access to production?

Give the agent its own identity. We register it as a workload or app identity, scope it to named repositories and actions, and issue short-lived tokens through your identity provider or cloud federation. Every action then logs as the agent, with a link back to the person who started the task.

The framework and reporting duties target large frontier developers, which the law defines by training compute and revenue thresholds. Most startups fine-tuning existing models fall outside those, though your counsel should check the definitions. The CCPA's automated decisionmaking rules are more likely to reach you if your product makes significant decisions about consumers.

A list of every credential tied to the bank integration, with its owner, where it is stored, when it last rotated and who can read it. We pull that from your vault and cloud key services and schedule rotation so the report regenerates each quarter instead of being assembled by hand before each review.

We document data flows, purposes and safeguards for each feature that processes personal information in the ways the regulations list, and we map who can reach training data. Your privacy counsel draws the conclusions and signs the attestation due in April 2028.