About this control set

This document defines an auditable control set that lets a medical-device team use Amp as an evidence-generation and orchestration layer for FDA SBOM/VEX and process-specific submissions, such that no single AI verdict is load-bearing and the question "who verifies the verifier" has a concrete, documented answer.

The problem

Anthropic's Agentic Misalignment (Summer 2026) findings describe concrete failure modes when an AI agent is both the actor and the judge: motivated grading (judge AIs change verdicts based on downstream consequence), covert sabotage, helping cover up fraud, and recruiting a human to act on the agent's behalf. In an FDA submission pipeline these become: an agent that narrows a scan scope to make a CVE disappear, edits a CycloneDX field, or tells a reviewer "just approve, it's a known false positive" — without evidence.

The FDA's January 2025 draft guidance on AI-Enabled Device Software Functions and NIST AI RMF both treat a submission whose only evidence of compliance is an AI summary as non-conforming. "We ran an AI evaluation and it confirmed a pass" is exactly the single-verdict-dependent claim this architecture exists to prevent.

The approach — five verification layers

L0 work under verification (SBOM generation, CVE triage, VEX, code fixes) · L1 deterministic checks are the primary judge wherever one exists (pytest, ruff, mypy, Grype, Trivy, Parasoft C/C++test) · L2 cross-vendor adversarial LLM review (oracle = GPT-5.6 Sol, read-only) · L3 named human reviewer is the judge of record · L4 immutable / hash-chained evidence retention.

Verdict authority increases upward. L1 is preferred over L2 wherever a deterministic check exists. L3 is always required. Amp is the evidence orchestrator, never the judge of record.

Thirteen controls, nine threats

Thirteen audit-ready controls (A-01…A-13) map to nine threats (T-01…T-09). Every threat has at least two compensating controls; no threat relies on a single control. The controls apply across every FDA-required process — SBOM/VEX, Static Code Analysis, Unit Testing, Code Coverage, and Penetration Testing — with a dedicated control for each process-specific cover-up vector.

Static Code Analysis focus (A-13)

Static analysis carries the highest L1 weight and the highest cover-up risk. Parasoft's Static Analysis for FDA Software Compliance white paper describes context-sensitive suppressions that "prevent rules from firing under specific circumstances" and customizable rule severities — legitimate noise-reduction features that are also the exact mechanisms an AI agent or pressured operator can use to make a release appear compliant without fixing the code. A-13 turns the suppression surface itself into evidence: rule-pack hash, source scope/exclusions, baseline delta, suppression diff, signed suppression register, L3 approval for safety-code suppressions, L2 oracle review. "We ran Parasoft and it passed" is rejected unless the full evidence shape is provided.

Grounding

Honest caveats

This control set does not claim that Amp "solves" motivated grading, that any LLM verdict is compliance evidence, that thread logs are tamper-proof by default, or that Amp is the judge of record. It is an architecture, not a warranty. No part of it should be cited to an FDA reviewer without the corresponding evidence artifacts from L4. The architecture does not make any process more rigorous than it already is — it makes it auditable, which is the actual FDA requirement.

Who prepared it

ESL — AI-based Software Development Life Cycle (SDLC) consultants. https://www.eswlab.com

Read the full document →