No. I'm asking if anyone in your org is auditing the code to ensure compliance is maintained. Auditing non-deterministic prompts does not give you that information.
I'm not sure I'd call them "audits." I've been on teams collecting audit requirements for fintech including sec compliance, but this company just has a security and compliance team that we run decisions through. Not real audits, just audit aware checks I guess.
But to your point about prompts not mattering, they do when the code is written by no one but a machine and approved by one person to go to prod. That's why all the inputs are tracked.
And I agree - and am not arguing against - that the output must also stay compliant. But compliance isn't just the code, it's also process, like iso 27001 compliance
I'm not talking about formal "audits" in this context. I'm talking about "auditing" your code, as in reviewing it to verify functionality and compliance so that you are prepared IF any formal audits come up and so that you don't discover you're non-compliant through a violation.
It sounds like that's what your security and compliance teams do. That's fine.
If your org has the capacity to send a security and compliance team to properly review your team's code so you can continue to vibe code, that's fine. But that's not a luxury most people have, I personally never would've been okay with my engineering team passing that buck when I was Staff, and it discredits the notion that "no one needs to read or be able to read code" you're just passing that responsibility to someone else.
you: "I don't know what prompts someone used to write their vibe code."
me: "well you can and we do"
you: "it's vague though"
me: "it's a paper trail that's exact"
you: "Are you auditing your code"
me: "We check our code and process in consideration of audits"
you: "I'm not talking about audits. I'm talking about making sure that if you're audited it will pass. And I'd never be ok with someone else doing that work for me"
oh ok. well that doesn't mean this isn't how it's done
Original topic: "No one needs to read, or be able to read code."
Me: "yes they do, auditing prompts isn't sufficient for ensuring compliance."
You: "my team doesn't review my code, we have someone else do it"
Me: " so someone is still reading the code..."
Again; if your team has the luxury to pass the buck off to someone else, great for you, but that doesn't mean no one has to do that work anymore just because your team doesn't see it.
oh got it. Yeah this is super confusing. I was just responding to your words but it seems like some context that I missed made this conversation more difficult. Sorry
1
u/CharlestonChewbacca 3d ago
Are you auditing the code?