Amended AU-C 500 asks firms to document six things about an AI or technology-assisted tool used in an engagement: what the tool is, how it was used, what it was given, what it produced, its limitations, and who signed off. A signed OpenChainGraph compute receipt already carries every one of those, in a form a reviewer can independently replay — not take on faith. This guide walks through the mapping, then a real replay a reviewer can run in their own browser.
Every field below is populated from a real signed OCG compute receipt — nothing here is narrative the auditor has to trust; each element is a value the reviewer can check against the receipt directly.
The receipt's kernel_id and engine digest identify the exact deterministic compute kernel that ran — not a product name, a specific pinned version.
The record composed by T561 states the analysis performed, in the auditor's own description, bound to the receipt it accompanies.
Inputs are represented as digests, with optional attestations where the source can be observed. Internal-tool and external-tool inputs are labeled differently — an external analysis is asserted, not observed.
The output payload's digest is bound into the receipt's execution_hash — a reviewer verifies the stated output is the actual output, not a description of it.
Expressed as a determinism class plus declared conventions — not as reassurance. A receipt says what was computed and how reproducibly, nothing more.
A countersignature slot binds a named reviewer's attestation to the receipt, composed by art-380 (build_ai_workpaper_record).
A reviewer does not have to trust the claimed execution_hash on a workpaper record — the Kernel VM Widget re-runs the same kernel in a sandboxed, deterministic VM and computes its own hash to compare against.
compute(policy_parameters) inside a sandboxed, deterministic in-browser VM, independent of the page that produced the original receipt.kernel_id and policy_parameters exactly as they appear on the receipt. The widget re-executes the kernel from those inputs alone — it does not read the claimed output.execution_hash alongside a native (non-sandboxed) re-run in the same tab. If both match the receipt's claimed hash, the record's output is exactly what the kernel produces from those inputs — not a description the auditor has to take on faith.