Out of model risk, not out of supervision
AI sits with operational risk. The bank designs, owns and challenges the controls itself.
Compliant by design
Compliance is not a final check. We design it into the process with your business and risk teams.
AI sits with operational risk. The controls are the bank's to build. We build them into the agent, not around it afterwards.
How we design and build an agent
- 01
Scope
Objective, key results, and the exceptions reserved for people.
- 02
Harness
Rules, data boundary, checks, stop condition. The process owner signs.
- 03
Seven layers
Input, model, guardrails, logs, monitoring, oversight, governance.
- 04
Test layer by layer
Adversarial cases scripted and run before every release.
- 05
Earn autonomy
The second line reads the dashboard and grants each step.
What it means for our clients
Validate the system, not the model
The old toolkit needs a specification to replicate and a target to test. An LLM system has neither.
The business signs the rules
Objective, limits, forbidden behaviours, data boundary, in plain language a process owner can own.
The second line stays outside the models
Different model, different evidence, a human owner. Monitoring is continuous; challenge is on the design.
Autonomy is earned
Suggest, then act with approval, then act alone, on evidence from the dashboard, never at go-live.
The paper
Compliant by Design sets out the seven-layer architecture in full, what the second line can test at each layer, what the US, EU and UK regimes each require, and the four actions for the interval before more specific guidance arrives.
Read the paper (PDF)No form, no email. 10 pages.The controls are part of the architecture, not a review after the fact.