The controls

IntegrityOps™

The governance and compliance layer inside AITLA. Controls written as code, enforced at runtime and recorded as they happen.

Status. AITLA is at its foundation stage: the architecture and policies are written, and the multi-agent runtime is being bootstrapped by the current system. No multi-agent system is serving customers yet.

The controls

Machine-consumable policies: Policies in four areas: the mandate, governance, communication and model selection. They are written for machines to read, so agents work within them and the runtime checks every action against them.
Runtime enforcement: Every request and every agent action passes the policy check before it takes effect: allowed, escalated to a human, or refused.
Separation of duties: No agent approves its own work. The developer agent’s approval of its own change is refused and recorded; an agent that did none of the work approves it.
Semantic audit trail: Every decision is recorded with what was decided, by which agent, under which policy and why, so an auditor reads reasons, not just events.
Human override at every level: A human can overrule any agent at any tier, and some decisions always need a person.

Figure 1. The policy check. Every request and every agent action is allowed, escalated to a human or refused, and each outcome is written to the audit trail.

What the policies encode

Regulations become rules the policy check can apply. Three examples:

Rule	What it asks	What a policy encodes
SEC Rule 17a-4	Broker-dealer records kept for set periods, in a form that can’t be altered or deleted, or with a complete audit trail of every change.	Retention as a requirement on every data store that holds such records; changes to it refused without approval and recorded.
OSFI Guideline B-13	Technology and cyber risk governed: changes managed, incidents handled, controls in place and evidenced.	Approval gates on every change, separation of duties, escalation paths and the audit trail as the evidence.
GDPR	Personal data limited to what is needed for the purpose.	No personal data in logs; redaction designed in, tested and checked in review.

These are examples of what the policies can encode. technologyDo is not certified against any of these rules, and no tool makes a firm compliant on its own.

Where the controls come from

These are the controls Seamus built and ran at DVB Bank, Barclays, Deutsche Bank, Scotiabank and RBC: change approval, separation of duties, escalation and audit, in organizations that answer to regulators. There they ran through committees and sign-offs. In IntegrityOps they are code. Seamus’s record