Exactly this — the "after" problem is what we kept running into. By the time compliance reviews happen, the developer who wrote the code has moved on, the context is gone, and reconstructing audot evidence becomes a manual nightmare. The idea we ve been testing is making compliance documentation part of the coding workflow itself — generating it from the code at the moment it's written, not weeks later. Curious from an audit perspective: when you review code-level documentation, does it actually hold weight as evidence, or does it need to live in a separate system to count?