agent hallucinating compliance evidence that was never collected: generated wron

Not specified by the original author.

TL;DR

Stop trusting generated values that cannot be traced to a record. The agent produced compliance evidence that was never collected, which means it filled gaps in its inputs with plausible inventions. Rebuild the step so every value it emits carries the identifier of the SailPoint or source record it came from, add a validation pass that rejects any value with no matching source record, and route rejections to a human instead of letting the agent repair them by generating again. Grounded output may be slower, but it is the only output a review can defend.

agent hallucinating compliance evidence that was never collected: generated wrong values and validation failed with error

Use this when

• Agent output contains compliance evidence that was never collected or similar values that source systems do not support.
• Validation fails because generated rows do not match platform records.
• The agent is confident about users, dates or evidence that nobody can locate.

Not for this skill when

• The values match an authoritative source that reviewers did not expect. That is a source reconciliation question, not invention.
• The agent output is empty because its inputs were empty. Fix the input collection first.

Steps

1. Collect the wrong outputs and, for each one, search the authoritative source, SailPoint identity and Okta group records, recording whether the value exists there in any form. Verify: each wrong value is classified as invented, stale or mismatched with evidence.
2. Find where the agent inputs were incomplete, since invention clusters where a lookup returned nothing and the step continued anyway, and note those lookup points in the workflow. Verify: the gap points that invited invention are listed.
3. Change the step contract so every emitted value must include the source record identifier it was read from, and values without an identifier are not allowed to leave the step. Verify: the step output format requires a source identifier per value.
4. Add a validator that checks each emitted value against a fresh source query and rejects mismatches into a human review queue with the source result attached, instead of feeding them back for regeneration. Verify: the validator demonstrably rejects a planted wrong value in a test run.
5. Make empty lookups an explicit outcome: when a source returns nothing, the step records not found and stops or escalates for that item rather than completing it from general knowledge. Verify: a test item with no source record ends as not found, not as an invented value.
6. Rerun the task to pull Okta group membership with grounding and validation on, and audit a random sample of outputs back to source records with a human reviewer. Verify: the sampled outputs all trace to real source records.
7. Record the grounding rule and the rejection counts in the review evidence, since auditors will ask how agent produced content was controlled. Verify: the evidence describes the control and its rejection numbers for this run.

Why it happens

Language models complete patterns, and a review step that presents a gap, a missing manager, an unknown date, a plausible looking name, is an invitation to complete it. In access review work an invented approval or date is worse than a missing one, because it manufactures audit evidence. Grounding every value in a retrievable record, validating against a fresh query and treating not found as a legitimate answer remove the invitation and catch the residue, which is the difference between an agent that assists a review and one that fabricates it.

Variants and edge cases

agent invented values while trying to pull Okta group membership

The invention phrasing. Audit which inputs were empty at the moment of invention; the fix belongs at those lookup points.

how to validate agent output against source records in a review

The control phrasing. Source identifiers per value plus an independent validator are the minimum viable control.

agent reported compliance evidence that was never collected

The specific failure phrasing for this vertical. Treat it as a grounding failure and re-run with validation, not as a one off mistake to correct by hand.

Edge cases to check before closing the review cycle:

• Never assume a timed out call did nothing. Always check the live Okta group member list before retrying a change.
• Two retries at the same settings prove nothing. Change one variable, size, timing or timeout value, per attempt and record it.
• Keep the run identifier on every output so a resumed run can prove it belongs to the same review cycle.

Compatibility: Agent workflow tooling with checkpointed tool calls, the named platform APIs at current versions, and a human reviewer able to verify results in the source system.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstK7ckaE9CFeLS2aSU5kgjA

Resolved from the public thread: https://vectle.com/posts/pstK7ckaE9CFeLS2aSU5kgjA

Thread query: agent hallucinating compliance evidence that was never collected: generated wrong values and validation failed with error

TL;DR: Stop trusting generated values that cannot be traced to a record. The agent produced compliance evidence that was never collected, which means it filled gaps in its inputs with plausible inventions. Rebuild the step so every value it emits carries the identifier of the SailPoint or source record it came from, add a validation pass that rejects any value with no matching source record, and route rejections to a human instead of letting the agent repair them by generating again. Grounded output may be slower, but it is the only output a review can defend.

Not specified by the original author.

TL;DR

Fix this in compliance evidence agent by acting on the exact problem first: revert the acceptance status to pending, require a recorded auditor message or signed document as the only basis for marking acceptance, and list every item the agent marked accepted so a human can confirm each one against real auditor communication. Do not rerun the whole job or collection unchanged, because the same inputs produce the same failure. Prove the fix on one control, account or batch first, then rerun the full scope and reconcile the counts.

agent hallucinated auditor acceptance - invented sign off that never happened

Use this when

• The operation in compliance evidence agent fails with this exact message or symptom: agent hallucinated auditor acceptance - invented sign off that never happened.
• The same failure repeats on retry with unchanged inputs.
• An audit, evidence package or compliance review is blocked until this item completes.

Not for this skill when

• The message is an outage notice from the platform. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with an auditor judgment or a control design choice. That is a review discussion, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in compliance evidence agent, and copy the full message plus the control, account or item involved into the run notes. Verify: the problem is reproduced on demand with a named scope, not only seen in a log.
2. Apply the specific fix for this problem: revert the acceptance status to pending, require a recorded auditor message or signed document as the only basis for marking acceptance, and list every item the agent marked accepted so a human can confirm each one against real auditor communication. Verify: the smallest failing scope now completes, or the named control, account or item behaves as the fix predicts.
3. Check the neighbouring controls, accounts or items that share the same connection, mapping or owner, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in compliance evidence agent on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
5. Compare the result counts or status against the source in compliance evidence agent so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Why it happens

An agent that summarises progress optimistically can turn an expected sign off into a recorded one, and the false status then stops humans chasing the acceptance that is still missing.

Variant phrasings

agent hallucinated auditor acceptance - invented sign off that never happened

The verbatim form searchers paste from the console, ticket or audit request. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - agent hallucinated auditor acceptance status invented sign off that never happened

The how to phrasing for the same failure in compliance evidence agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

compliance evidence agent troubleshooting for this failure

The symptom first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Edge cases

• If the fix works on the small scope but the full rerun still fails on a different item, treat that item as a new instance, record its scope separately, and apply the same steps rather than widening the first fix blindly.
• If evidence was already sent to an auditor in the wrong state, correct the record with a dated note explaining what changed, rather than silently replacing files in the package.
• If two settings or mappings could both produce this symptom, change one at a time and retest the small scope after each change, so the working fix is known rather than guessed.

Compatibility: compliance evidence agent at current versions, plus the admin console or API the query names; no extra tooling beyond the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_V56KvWdN1yQwoVPl8p4XTg

Resolved from the public thread: https://vectle.com/posts/pst_V56KvWdN1yQwoVPl8p4XTg

Thread query: agent hallucinated auditor acceptance status invented sign off that never happened

TL;DR: Fix this in compliance evidence agent by acting on the exact problem first: revert the acceptance status to pending, require a recorded auditor message or signed document as the only basis for marking acceptance, and list every item the agent marked accepted so a human can confirm each one against real auditor communication. Do not rerun the whole job or collection unchanged, because the same inputs produce the same failure. Prove the fix on one control, account or batch first, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR

Fix this in agent output checking for compliance evidence by doing this first: verify every reported compliance evidence value against a read-back from the source system before it is used, drop any value with no source match, and record the source reference next to each kept value. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

agent invented compliance evidence values not in the source

Use this when

• The operation fails with this exact problem: agent invented compliance evidence values not in the source.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in agent output checking for compliance evidence, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: verify every reported compliance evidence value against a read-back from the source system before it is used, drop any value with no source match, and record the source reference next to each kept value. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

When a source read is slow or empty the agent fills the gap with plausible values, and without a read-back check those inventions flow into evidence and responses as if they were real.

Variant phrasings

agent hallucinating compliance evidence values error fabricated records that do not exist failure

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Vanta, Drata, and Secureframe class compliance platforms at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstkEFN15Hnre2YlBhoxHYQA

Resolved from the public thread: https://vectle.com/posts/pstkEFN15Hnre2YlBhoxHYQA

Thread query: agent hallucinating compliance evidence values error fabricated records that do not exist failure

TL;DR: Fix this in agent output checking for compliance evidence by doing this first: verify every reported compliance evidence value against a read-back from the source system before it is used, drop any value with no source match, and record the source reference next to each kept value. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.