This reminds me of things like SOX, HIPAA where for any set of compliance/audit requirements there is a layer of people in the middle who always suggest to add

This reminds me of things like SOX, HIPAA where for any set of compliance/audit requirements there is a layer of people in the middle who always suggest to add all kinds of un-necessary things "just in case" it might be required. These suggestions are based on their interpretation or pre-empting of the compliance process rather than anything that is actually explicitly required. Why can't the auditors explicitly state what needs to be auditable about io_uring? Instead of guessing and debating.