# Vought Signed DOGE's CFPB Access Deal. The Audit Logs Congress Needed Never Reached Its Watchdog.

Published: 2026-10-31

The decision originated with the administration of [Donald Trump](https://factrail.ai/people/donald-trump), but the GAO report does not establish that every access was improper. This is also a [fiscal sustainability](https://factrail.ai/drivers/fiscal-policy-sustainability) question because public institutions must demonstrate that savings programs retain effective audit controls.

Factrail investigative analysis | United States | Evidence cutoff: 31 October 2026 | Source review completed

The finding. [President Donald Trump](/people/mig-donald-trump) ordered federal agencies to give his government-efficiency operation broad access to unclassified systems while requiring rigorous data protection. At the Consumer Financial Protection Bureau, acting director [Russell Vought](/people/russell-vought) and DOGE adviser Steven Davis signed an assignment agreement on February 7, 2025; a related agreement explicitly contemplated cooperation over Government Accountability Office inquiries. Yet when GAO sought the account permissions and activity logs needed to verify safeguards, the bureau did not provide them. Its September 29, 2026 report found that four of six reviewed agencies reported DOGE access to more than 23 systems, while two others would not identify the systems at all. That is an accountability failure in the documentary record, not proof that DOGE stole, sold, altered or leaked anyone's data. The political gain was accelerated operational access; the financial beneficiaries and actual data consequences remain unverified. [S01][S03][S04][S05]

## A right to enter and a duty to protect

The decisive sentence in Executive Order 14158, signed by Trump on January 20, 2025, did two things at once. It instructed agency heads, within the limits of law, to ensure that the renamed United States DOGE Service (USDS) received full and prompt access to unclassified agency records and technology systems. It also directed USDS to follow rigorous data-protection standards. Section 3 told each agency head to assemble a DOGE team in consultation with the USDS administrator; section 4 made software modernization and responsible data synchronization the stated rationale. The order did not repeal federal privacy statutes, transfer statutory responsibilities from agency heads, or create an unrestricted right for individual employees to use data for private purposes. [S03]

The order's design matters because it separated three powers that headlines often collapse. The president supplied the cross-government instruction. Agency heads and authorized officials had to decide who was hired, detailed, provisioned and supervised. Security officers and system owners had to implement the access permissions, training, monitoring and offboarding. A team member's ability to see a procurement screen is not the same as authority to approve a procurement, and a technical ability to change a personnel record is not evidence that the record was changed. Those distinctions are central to the subsequent audit. [S01][S03]

The executive order also created a temporary USDS organization scheduled to end on July 4, 2026. It expressly said that this sunset did not automatically terminate the broader USDS organization or other provisions of the order. Therefore the September 2026 GAO report cannot be dismissed merely because the temporary unit's planned end date had passed. Nor does that report establish that every original detailee retained access after July 4. Each account's creation, privilege history and deactivation would have to be checked separately. [S01][S03]

## The documentary trail: February 2025 to September 2026

On February 7, 2025, Vought, then acting CFPB director, signed an assignment agreement with Steven Davis, identified on the document as the USDS approver and special adviser. It required the bureau to furnish equipment, accounts and system access to assigned staff, including access within one business day of a written request. The same document directed CFPB to identify conflicts of interest, maintain project records and coordinate with USDS counsel when congressional, inspector-general or GAO oversight inquiries arose. It made the CFPB director or designee the supervisor of the assignees' work at the bureau, while USDS retained a role in allocating resources. [S04]

On February 14, CFPB and USDS documented separate terms for reimbursable and nonreimbursable work. The document names CFPB chief operating officer Adam Martinez and USDS senior adviser Davis in its signature section. It specifies an arrangement for up to five full-time-equivalent positions for which USDS could seek reimbursement, monthly financial reconciliation, possible advance payments, and return of unused money. It also calls for notification and coordination over GAO and other oversight inquiries, record retention, information-security compliance and conflict checks. The agreement itself explicitly says that it does not constitute an obligation of funds. It does not give an audited amount paid, a supplier invoice or a private company's receipt. [S04]

Between January 23 and February 12, 2025, the Education Department onboarded six DOGE team members, according to information later supplied to GAO. The SEC reported two team members arriving in March and April. NOAA reported detailees reviewing contracting and financial-assistance systems. At CFPB, six members formed the core team described in the audit. These are agency-specific implementation steps, not evidence that the same individual controlled every system or that a central private contractor acquired the data. [S01]

GAO's performance audit ran from March 2025 to September 2026. Auditors sought lists of systems, permission levels, signed access agreements, training and screening evidence, and the logs showing what accounts actually did. They were able to reconstruct portions of the story from agency responses and court-filed declarations, but not the complete permission and activity history. GAO published its report, GAO-26-108192, on September 29, 2026. The report's six-agency sample is not a census of the federal government and does not establish that every DOGE team nationwide had the same deficiencies. [S01][S02]

The sequence produces Factrail's principal documentary comparison: the CFPB agreements explicitly anticipated oversight and described safeguards, yet the subsequent auditor could not corroborate critical safeguards through direct inspection of the bureau's accounts and logs. That gap is more precise than saying that an agreement was broken or that information was stolen. Coordination clauses are not themselves a guarantee of unrestricted disclosure, and GAO did not adjudicate a breach of contract. They do, however, identify who was supposed to preserve records and route oversight inquiries. [S01][S04]

## Nineteen systems at CFPB: what access meant

CFPB officials told GAO that DOGE team members had been given access to 19 administrative systems. The most consequential details were not merely the count. In the bureau's description, three team members had full access to Entra ID, a Microsoft environment used to manage identity and permissions. One team member, anonymized as F, could view, modify and delete data in HRConnect, the bureau's main human-resources system. The same person had view-only access to several finance and procurement tools, including an invoice platform and Oracle Business Intelligence. The reported permissions did not authorize that person to change the underlying data in those finance systems or terminate procurement contracts. [S01]

A further qualification is essential. CFPB said the DOGE team did not access systems containing market monitoring, supervision, enforcement or fair-lending information. The GAO report notes that two members had permissions sufficient to grant themselves or others access to those systems, but CFPB said they did not exercise that capability. Treating the potential ability to elevate privileges as actual access to enforcement files would misstate the evidence. Conversely, simply repeating the bureau's assurance without examining privilege and activity logs would not independently test it. [S01]

GAO's table also distinguishes systems that were provisioned but, according to CFPB, not used or used only for an initial login or tutorial. That is a narrower claim than wholesale downloading. In the same audit, the bureau documented that six team members received privacy briefings, four completed security training, and five signed certain security-related agreements. The missing documentation for remaining members does not prove they received no training or signed nothing. It means the auditor could not verify full compliance from the records provided. [S01]

The operational consequence is a question of control rather than a sensational estimate of leaked records. An identity administrator can potentially authorize additional access; a human-resources editor can potentially change employee data; a read-only contract reviewer may inspect sensitive procurement information without changing the contract. Each risk requires different evidence: assigned roles, timestamps, audit logs, exception approvals and the records of any action. GAO requested exactly the kinds of evidence that could separate permission from use. [S01]

## Five other agencies, five different gaps

Education reported two of six DOGE members had system or network access. One received limited access to the Federal Student Aid financial management system and Partner Connect, with no create, modify or delete permission reported for those two applications. The department said the first system access excluded personally identifiable information, but whether the second exposed such information was unclear to GAO. It later cited litigation and confidentiality concerns in declining further documentation. These facts do not support a claim that student-loan balances were changed. [S01]

NOAA said two detailees could view procurement and grant-management data, without modifying or deleting records in the three named systems. A third individual reportedly could create, modify and delete content on internal websites for changes related to diversity, equity and inclusion. GAO could not independently verify the complete access picture. The distinction is politically relevant: the permission to edit an internal webpage is not the same as permission to rewrite grants or divert appropriated money. [S01]

SEC officials reported read-only access to PRISM, a procurement and contract-management system, for one DOGE team member. They said a possible access grant to the Delphi financial-payments system was discussed but never made. Both team members completed initial privacy and cyber-awareness training, but the agency did not supply all documentation requested about other requirements and permissions. It is inaccurate to report a confirmed DOGE takeover of SEC payment processing from this record. [S01]

SBA did not identify the systems its DOGE team could reach or the permissions of individual members in the material GAO requested. VA officials said employees and contractors serving as DOGE liaisons received standard employee-level access, but the department did not provide a specific system inventory or verified permission history. GAO therefore could not establish the extent of access at either agency. Absence of a complete answer is not proof that a named veteran's medical record was viewed or changed. [S01]

Across the four partially responsive agencies, the phrase 'more than 23 systems' is a reported lower bound, not a count of confirmed data transfers, incidents or unique affected people. CFPB's 19 systems are part of that total, not an additional 19 to add to it. GAO did not determine the total number of records viewed, the amount of data copied, or a monetary value of any exposure. Inflating any of those unknowns into a damages estimate would turn an oversight finding into an unsupported accusation. [S01][S02]

## Who could authorize, withhold or compel?

The power map begins with Trump as issuer of the executive order, not as the operator of each account. The USDS administrator and agency DOGE leads coordinated staffing and work. Vought's signed February 7 assignment is an unusually direct record of a named political appointee enabling the CFPB placement. Davis signed on the USDS side. Martinez's name appears on the later terms governing operational arrangements. Agency information officers and managers were responsible for implementing specific controls. GAO's report anonymizes most team members, and its evidence does not establish that Trump, Vought, Davis or Martinez personally clicked through a particular personnel record. [S01][S03][S04]

The second chain is congressional. GAO is Congress's audit institution, not an executive department answering to DOGE. Section 716 of title 31 authorizes the Comptroller General to obtain agency records needed for audits, subject to statutory procedures and exceptions. The statute provides a formal escalation route: a written request to the agency head, a response period, a report to senior officials and Congress, and potentially litigation in the District of Columbia. The existence of that route is not evidence that GAO used every enforcement step in this particular review. [S05]

The SEC and NOAA took a narrower view of GAO's authority to undertake work requested by congressional ranking members. SEC also raised protection of certain information; Education raised pending litigation and privacy concerns; CFPB argued that further demands were duplicative or disruptive. GAO rejected the contention that those reasons eliminated its access rights and cited its own authority to initiate work and maintain confidentiality. A genuine institutional dispute is present, but the audit report is not a final judicial judgment resolving all potential privilege disputes. [S01][S05]

This is the practical veto point: the executive order could accelerate provisioning, while the audited agencies controlled the records necessary to independently reconstruct the provisioning and subsequent use. GAO could request and challenge refusals; it could not certify an account history it was not permitted to inspect. A political order and an audit statute can coexist on paper while leaving a gap in observable implementation. [S01][S03][S05]

## The money and beneficiaries: access is not a payout

The immediate, documented beneficiary was the executive modernization operation itself: USDS personnel gained authorized pathways into administrative systems for contract review, workforce analysis and technology projects. Agency managers could potentially use the work to identify inefficiencies. The public could benefit if those projects produced measurable savings without compromising security. Neither the six-agency report nor the signed CFPB agreement establishes that such savings were realized. [S01][S03][S04]

There is a narrower financial mechanism in the February 14 CFPB terms. USDS could seek reimbursement for up to five full-time-equivalent positions; it required advance payment for reimbursable services and monthly reconciliation against actual work. CFPB was also to cover relevant travel or training expenses. The agreement says that no funds were obligated by the document alone. A legitimate accounting investigation would compare subsequent orders, amounts advanced, actual time charges, refunds and appropriations. Without those records, a dollar figure for transfers or private profit would be invented. [S04]

Davis was publicly reported by Fortune in April 2025 as an executive associated with [Elon Musk](/people/elon-musk)'s Boring Company while participating in DOGE. That affiliation is relevant to scrutiny of potential conflicts and disclosure duties. It does not demonstrate that Boring Company received CFPB funds, won a contract, accessed bureau files, or profited from a DOGE decision. The agreement names federal parties and government staff, not Boring Company as a payee. Likewise, Musk's political prominence does not substitute for an account-level audit trail. [S04][S11]

Who bears the downside if safeguards fail? Employees whose personnel records are exposed, grant applicants and contractors whose submissions enter government systems, and taxpayers funding remediation could face risks. Those are conditional pathways, not established victims or measured losses in this audit. The article's beneficiary ledger therefore records operational access as observed, possible efficiencies as unverified, interagency reimbursements as contractually contemplated but unquantified, and private financial gains as unproven. [S01][S04]

## The strongest defense—and its limit

The administration's case is not intrinsically frivolous. Federal IT is fragmented, contracts can be difficult to reconcile and temporary specialists may need access to assess inefficiency. The January 2025 order explicitly imposed a protection duty and retained the requirement to act consistently with law. The CFPB agreements contained recordkeeping, security, confidentiality and conflict-management language. CFPB said it assessed risk, followed its policies, maintained logs and had no DOGE-related privacy or cybersecurity incident. SEC also reported no such incident. Education and NOAA described some access as limited or read-only. [S01][S03][S04]

A particularly useful control comparison comes from GAO's separate April 2026 report on the National Labor Relations Board. There, auditors examined sign-in logs and found no evidence that two DOGE detailees used the specified systems during the April 16–July 25, 2025 agreement period. That finding did not resolve separate allegations concerning an earlier period, which an inspector general was investigating. It nevertheless shows what a narrowly scoped negative finding can look like when logs are available. In the six-agency review, GAO could not perform an equivalent verification across the requested accounts. [S07]

The Treasury case shows the opposite, also with more direct evidence. In an April 2026 audit of Fiscal Service payment systems, GAO found that a DOGE employee was temporarily given permissions to create, modify and delete in one system but found no evidence that data were changed. It also found an instance in which payment information was transmitted outside the bureau without the required encryption and approval. That is an actual documented control failure in a different agency and review period; it must not be falsely attributed to the six agencies in the September report. [S06]

CFPB disputed the September report's fairness and accuracy, saying GAO's presentation suggested malign intent and underweighted its evidence. GAO responded that it was describing system risks, not accusing staff of searching through consumers' files, and that its audit standards required corroboration where possible. The bureau argued that much training belonged to the detailees' home agencies and that further requests were burdensome; GAO pointed to bureau policies that applied to users and said it still lacked the needed evidence. Readers should weigh the bureau's explanations without mistaking them for independently verified system logs. [S01]

Independent reporting by FedScoop and Nextgov confirmed the core dispute and sought agency comment. FedScoop reported that SEC declined to comment and the other five agencies had not responded by publication; it also reported Senator Gary Peters' criticism of the administration's cooperation with congressional oversight. Bloomberg Law separately described the same audit. These accounts establish independent public scrutiny, not an extra set of technical log findings beyond GAO's original work. [S08][S09][S10]

## What would change the verdict?

The most valuable missing evidence is mundane: dated user-provisioning records, precise privileges by account and system, sign-in and administrative-action logs, training certificates, background-check adjudications, incident-management records, deactivation dates and any exceptions approved by responsible officers. A complete set could show proper compliance, reveal narrower problems, or document actual unauthorized activity. GAO's inability to inspect it cannot decide among those possibilities. [S01]

The second missing set is financial. CFPB–USDS orders and monthly reconciliations could establish whether advance reimbursements occurred, what work was billed, whether money was returned and whether any outside contractor benefited. No such outcome is established here. A third question is institutional: whether agencies subsequently supplied GAO with requested materials, and whether any court or formal congressional process compelled production after the September report. This article has not verified such a later resolution as of October 31, 2026. [S01][S04][S05]

The central conclusion is accordingly firm but bounded. Trump authorized an extraordinary cross-agency access initiative, Vought and Davis documented one bureau's implementation, and GAO could not verify the scope and controls at six selected agencies because necessary records were not furnished. The signed CFPB arrangements make the failure of external verification more consequential, not automatically criminal. Until account logs and payment records are independently examined, neither the claim that the initiative was securely controlled everywhere nor the claim that it stole data or enriched private actors is documented assessment. [S01][S03][S04]

## Documentary source register

- S01 — U.S. Government Accountability Office, DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies, GAO-26-108192, accessible full report, September 29, 2026:
- S02 — GAO report summary and agency-response overview, September 29, 2026: https://www.gao.gov/products/gao-26-108192
- S03 — [White House](/organizations/white-house), Executive Order 14158, Establishing and Implementing the President's [Department of Government Efficiency](/organizations/department-of-government-efficiency), January 20, 2025: https://www.whitehouse.gov/presidential-actions/2025/01/establishing-and-implementing-the-presidents-department-of-government-efficiency/
- S04 — CFPB-hosted original USDS–CFPB assignment and reimbursable-work agreements, February 7 and 14, 2025 (published file accessed October 2026):
- S05 — U.S. House Office of the Law Revision Counsel, 31 U.S.C. §716, statutory access to agency records (text through October 9, 2026):
- S06 — GAO, Treasury Needs to Fully Implement Data Protection Controls, GAO-26-108131, April 28, 2026: https://www.gao.gov/products/gao-26-108131
- S07 — GAO, NLRB Detailees Did Not Access IT Systems Between April 16 and July 25, 2025, GAO-26-108774, April 28, 2026: https://www.gao.gov/products/gao-26-108774
- S08 — Matt Bracken, FedScoop, Agencies largely stonewall GAO on audit of DOGE's data practices, September 29, 2026: https://fedscoop.com/gao-report-doge-data-security-federal-agencies/
- S09 — David DiMolfetta, Nextgov/FCW, Agencies withheld records needed to verify DOGE data safeguards, September 29, 2026: https://www.nextgov.com/policy/2026/09/agencies-withheld-records-needed-verify-doge-data-safeguards-gao-says/416305/
- S10 — Ian Kullgren, Bloomberg Law, Agencies Withheld Information on DOGE Data Access, Watchdog Says, September 29, 2026: https://news.bloomberglaw.com/environment-and-energy/agencies-withheld-information-on-doge-data-access-watchdog-says
- S11 — Jessica Mathews, Fortune, Here is the agreement DOGE has with the CFPB about its cost-cutting efforts, April 10, 2025: https://fortune.com/2025/04/10/here-is-the-agreement-doge-has-with-the-consumer-watchdog-agency-it-is-cutting-up/

## Sources retained from the live page

- [https://www.gao.gov/products/gao-26-108192](https://www.gao.gov/products/gao-26-108192)
- [https://www.whitehouse.gov/presidential-actions/2025/01/establishing-and-implementing-the-presidents-department-of-government-efficiency](https://www.whitehouse.gov/presidential-actions/2025/01/establishing-and-implementing-the-presidents-department-of-government-efficiency)
- [https://www.gao.gov/products/gao-26-108131](https://www.gao.gov/products/gao-26-108131)
- [https://www.gao.gov/products/gao-26-108774](https://www.gao.gov/products/gao-26-108774)
- [https://fedscoop.com/gao-report-doge-data-security-federal-agencies](https://fedscoop.com/gao-report-doge-data-security-federal-agencies)
- [https://www.nextgov.com/policy/2026/09/agencies-withheld-records-needed-verify-doge-data-safeguards-gao-says/416305](https://www.nextgov.com/policy/2026/09/agencies-withheld-records-needed-verify-doge-data-safeguards-gao-says/416305)
- [https://news.bloomberglaw.com/environment-and-energy/agencies-withheld-information-on-doge-data-access-watchdog-says](https://news.bloomberglaw.com/environment-and-energy/agencies-withheld-information-on-doge-data-access-watchdog-says)
- [https://fortune.com/2025/04/10/here-is-the-agreement-doge-has-with-the-consumer-watchdog-agency-it-is-cutting-up](https://fortune.com/2025/04/10/here-is-the-agreement-doge-has-with-the-consumer-watchdog-agency-it-is-cutting-up)

## Methodology

https://factrail.ai/methodology

Canonical: https://factrail.ai/articles/trump-doge-cfpb-gao-access-logs-oversight-2026