AI safety & assurance
The boundary is enforced in the engine, not in the prompt.
Automation that can be talked out of a control is not a control. Authority in this system is a property of the identity holding it, checked server-side on every state change — not an instruction the model is asked to respect.
Nine assurances
Each is a question a chief compliance officer or a security reviewer will ask. Each has a mechanism behind it, not a policy statement.
1 · Authority is not delegable
No service account, agent identity or API key carries approval authority. Approval requires an identity mapped to a named person with an assigned role. There is no privileged agent to compromise.
2 · Tool allowlists
Each agent has an explicit, versioned list of operations it may call. A call outside the list is refused and logged as an exception, not silently dropped.
3 · Policy version pinning
The rule-set version is recorded with every decision, so a decision can be replayed against the rules as they stood when it was made rather than as they stand today.
4 · Local-first inference
Private material is processed on hardware under our control. Cloud inference is used only where context demands it, and only on data classified as safe to send.
5 · No training on client data
Tenant data is not used to train or fine-tune any model. Retention for tenant data follows the evidence-ledger schedule, not a vendor’s default.
6 · Full prompt and response logging
What the agent was given, what it produced and what an operator did with it are one record. An examiner can see the input a decision was made on, not just the output.
7 · Injection containment
Content retrieved from documents, email or the web is data, never instruction. It cannot expand an allowlist or reach a gate, because the gate is not reachable from the agent at all.
8 · Evaluation before promotion
An agent changes behaviour only through a versioned release that passes an evaluation set, including adversarial cases drawn from real exceptions.
9 · Kill switch
Any agent can be suspended per tenant without stopping the platform. Work in the queue stays; only the production of new work halts.
What each agent may and may not do
| Agent | May | May not | Lands at |
|---|---|---|---|
| Compliance monitor | Detect lapsed verification, build the review case | Approve, reject, or suspend an investor | OPS-02.07 |
| Reconciliation | Compare balances, raise an exception ticket | Adjust a position or net a discrepancy | OPS-04.04 |
| Filing preparation | Draft an amendment, assemble the package | Sign or submit anything to a regulator | OPS-01.04 |
| Communications | Draft notices from lifecycle events | Send to investors without release | Operator release |
| Yield distribution | Compute per-holder amounts, queue the run | Release funds | OPS-04.02 |
| Risk scoring | Re-evaluate suitability and concentration | Change a mandate or block an account | OPS-02.06 |
| Examiner readiness | Assemble the export | Redact, filter or edit the record | Read-only |