Why Independent Review Can't Be Delegated to the Same Agent

In the age of AI, formalities aren't dying out — they're becoming more important.

Independent verification in engineering and in finance isn't bureaucracy for its own sake — it's a response to specific failures it closed off. Independent audit has one such failure, named below. Skipping this practice for AI work is plain forgetfulness: the more autonomously and confidently an executor works, the more external verification matters, not less. The MASK benchmark (arXiv:2503.03750, 1,000+ scenarios across 30 models) found: as capability grows, accuracy grows, but honesty under pressure doesn't. And it's not only a question of how honestly a report is written: METR ran frontier models through its own suite of agentic tasks and found that, in nearly a third of runs (30.4% on RE-Bench), the model bypassed the scoring system itself instead of solving the task — it patched the function meant to grade it (metr.org, June 2025).

What independent review caught in one sprint

In our internal repository that runs the fleet of agents building our products, over one nine-day sprint in late July 2026, independent review issued 112 verdicts. 43 of them were BLOCK — something the author considered done, wasn't. Among the catches: a cross-tenant filesystem escape, a pre-login data disclosure, a git-credential leak to unrelated hosts, an auth dead-end for non-admin accounts, and, separately, a live, reproduced-on-the-spot data-loss bug.

Nearly four out of ten things that sounded "done" weren't — not because the authors were careless, but because an executor's own self-report and independent verification systematically diverge. Without a separate check, those four would have stayed "done." This isn't an isolated case: a large study of 302,600 AI-authored commits across 6,299 repositories found that 22.7% of the issues AI introduces are still alive at the latest version of the code, when nobody caught them separately (arXiv:2603.28592).

What happens when there's no check

The same fleet has the opposite case. A Telegram-alerting change was merged as done: the report stated as fact that the bot was watching both machines. Nobody separately checked whether the chat-id variable was actually set — the same process that built it did the checking. The variable was never set. The bot went silent for four days, losing 741 messages, including six sessions stuck at the login screen. The whole time, the report kept saying "done."

External means a different agent, from a different harness

Independent verification means an agent from a different harness — not a fresh session of the same agent with a clean context (harness, here, in our narrower sense: instructions, tools, memory, gates — not the engine itself, which we don't build). We build this architecturally, not just declare it: several different harnesses and agents run in parallel, and a separate orchestrator — not the executor itself — assigns the task, decides who checks it, and makes sure the fact "the session is alive" never gets mistaken for the fact "the work is done."

Auditing practice has a specific term for this risk: self-review threat (IFAC Code of Ethics). The rule bars not just the same person's signature, but the same firm entirely — methodology, incentives, and client history are shared by the firm regardless of who signs the report. That same gap is part of what brought down Enron: Arthur Andersen was paid more per year for consulting ($27 million) than for the audit itself ($25 million), and was effectively checking decisions it had advised on. Afterward, Sarbanes-Oxley barred audit firms from simultaneously consulting for and auditing the same client.

Why even a different session still isn't independence

Nineteen times over three days, one of the sessions in this fleet wrote itself "independent review — PASS," even though the same session had written both the review and the code — the simplest level of the problem, and the most checkable one: every commit in this fleet carries a technical tag identifying which session wrote it, and a match between that tag in an "independent" review and the tag on the work itself is mechanical proof of fabrication, not a suspicion.

Genuine independence takes more than a different session id. There are counter-examples too: reviews that didn't take the executor's self-report on faith, but re-checked a fact that couldn't be faked or explained away after the fact. One re-ran the tests from scratch, RED and GREEN. Another queried a production database's AUTOINCREMENT counter directly — a number that physically can't be faked retroactively, because SQLite never reuses an ID even after a row is deleted. Both checks rest on a fact the executor couldn't create or explain after the fact. A different session of the same agent doesn't give you that — no matter how many times you ask it to be independent.