Open the reviewing pane in any Word document and every tracked change carries a name and a timestamp. For thirty years that was a complete answer to the question of who wrote what. The person whose name is on the insertion typed the insertion. Attribution came free with the software.
AI-assisted writing quietly broke this, and most tools have not noticed. When a model completes your sentence, or rewrites a paragraph you selected, or fills a gap you pointed it at, the text usually lands in the document under your identity. The reviewing pane says you wrote it. The document's revision history, the thing an auditor would consult to establish who did what, now contains a systematic falsehood: a human name on machine-generated text.
For most writing that is a curiosity. For a document going into a regulatory submission it is a data-integrity problem with an existing name.
Regulators answered this before AI writing existed
The rules here were not written for language models. They were written for lab instruments, chromatography systems and clinical databases, and they transfer cleanly.
MHRA's GXP data-integrity guidance requires that data be attributable to the person who generated it, or, where a system generated it automatically, to that system. It is also blunt that shared identities are unacceptable: two people writing under one login makes the record meaningless, because attribution is the whole point. EU Annex 11 asks that systems record the identity of operators entering, changing, confirming or deleting data, with date and time. And 21 CFR 11.10(e) requires a secure, computer-generated, time-stamped audit trail in which "record changes shall not obscure previously recorded information."
Read those with an AI writing tool in mind and the conclusion is uncomfortable. A tool that inserts model output under the writer's name has created a shared identity between the writer and the model. The record cannot distinguish the sentence the writer typed from the sentence the writer merely accepted, which means it also cannot answer the only question that matters when a number turns out to be wrong: did a person write this, or did a person approve it?
Those are different acts. A writer who typed "the median duration of response was 14.1 months" either read the source or didn't, and is accountable either way. A writer who accepted that sentence from a model performed a review, and the quality of that review depends on what they were shown and what they had time to check. An inspector reconstructing how an error entered a dossier needs to know which of the two happened. A record that shows a human name in both cases has destroyed the distinction.
Three origins, not two
When we designed the document record that Asthra's storage is built on, we started from that distinction and found it wasn't binary. Every revision to a regulated document has one of three origins, and the record has to capture which.
| Origin | Recorded author | Recorded cause |
|---|---|---|
| The writer edits directly | The writer | User edit |
| The writer commands the machine | The agent, acting on behalf of the writer | Regenerate, chat-driven edit, accepted suggestion |
| The machine acts within its own flow | The agent alone | Run drafting, source reconciliation, audit pass |
The first origin is ordinary authorship. The writer typed it, the writer's name goes on it, same as it ever was.
The second is where most AI tools get the record wrong. The writer asks for a regeneration, or points the agent at the source that resolves a flag, or accepts a suggested rewrite. The intent is human. The prose is not. So the revision is attributed to the agent, with the model identifier and the run that produced it, and it carries an on behalf of field naming the writer who asked. The writer is recorded as the commander of the change, never as its author. This follows the MHRA position on machine-generated data directly: the machine generated it, so the machine is the source, and the human's role, which is real and worth recording, is captured as exactly what it was.
The third origin has no human in it at all. When Asthra drafts a full document overnight, or reconciles sections after a source document changes, or runs an audit pass, those revisions belong to the agent alone, tied to the run that produced them. Nobody commanded that specific sentence into existence, and the record should not pretend otherwise.
One consequence of taking this seriously: the author field is resolved on the server, from the authenticated identity on the request, and anything the client declares about who is writing is ignored. A record you can populate by assertion is a record you cannot trust. The same reasoning shows up elsewhere in the product; the tracked-changes behaviour in flag resolution is enforced by infrastructure rather than requested of the model, and this is the storage-layer version of that choice.
The rest of the record follows
Once every revision knows its origin, the remaining design decisions are the boring, load-bearing kind that data-integrity guidance has required of regulated systems for years.
Revisions are append-only. An edit does not overwrite the previous text; it becomes a new numbered revision that points at the one it replaced, with the prior content retained in full, which is what 11.10(e) means by changes not obscuring previously recorded information. Revision numbers only count upward, so a regeneration cannot reset a section's history to zero. Timestamps come from the server clock, in UTC, because a record whose ordering depends on the writer's laptop clock is not an ordering. Each revision row carries a hash over its own content, so tampering is detectable. And nothing in the regulated collections expires on a shorter clock than the submission itself, since an audit trail retained for less time than the record it explains is not an audit trail.
Above the revision layer sits a version layer: named, frozen cuts of the document, with the constraint that exactly one version of a document can be Effective at a time, enforced as a database invariant rather than a procedure someone follows. A signature, when it arrives, binds to the content hash of a frozen version, which is how Part 11 wants signatures attached, so that "editing an approved document" is not possible even in principle. What the system does instead is open the next draft version, and the approved one stays exactly as signed.
None of this is visible in the Word document, and that is the point. We have argued before that the document was never the source of truth; it is a render of state that lives elsewhere. This is what that state has to look like for the render to be worth trusting. When an inspector asks who changed the hepatotoxicity paragraph between the first and second cycle, and when, and why, the answer should be a query, and the answer will name a person only when a person actually wrote the words.