AI Studio · 5 capabilities
— How it fits together
AI Studio · Architecture
5 capabilities · 1 governed fabric
— Sources
— Multi-agent AI core
— Governed outcomes
Grounded
Every claim cited to source evidence
Auditable
Prompts, outputs & approvals immutably logged
Isolated
Tenant-scoped · no training on customer data
— Multi-agent rule generation
A risk analyst, data engineer, control tester and reviewer agent negotiate around a shared Rule Forge. Each turn the rule gets sharper — citations attached, thresholds tuned, code self-tested — until a human reviewer signs off and it ships to continuous monitoring.
Now · Audit lead
An auditor describes the risk in plain language — e.g. "detect segregation-of-duties breaches in vendor payments over the last 24 hours." The brief is logged with engagement, framework and severity context.
Risk Analyst
Decomposes intent into testable risk hypotheses and control objectives.
Data Engineer
Maps controls to source systems, picks tables and writes the query.
Control Tester
Runs the rule on sample data, tunes thresholds, surfaces exceptions.
Reviewer Agent
Critiques output, demands citations, escalates to human reviewer.
Audit reviewer · sign-off
Reviews the full agent transcript, evidence and tests. Approves, edits or rejects — nothing ships without this signature.
rule "segregation_of_duties.payments" { intent = "Detect SoD breach: create_vendor + approve_payment by same user (24h)" population = sql("SELECT user_id, role FROM erp.payment_actions WHERE created_at >= now() - interval '24h'") exception = same_user_did(["create_vendor", "approve_payment"]) severity = "high" evidence = ["payment_actions", "user_roles", "approval_log"] reviewer = require_signoff("audit.controls.sox")}
Framework
Plan → Code → Validate → Deploy
Every rule walks the same governed pipeline, with each stage owned by a specialised agent and gated by checks.
Approach
Critic-in-the-loop
A reviewer agent challenges every draft against evidence and policy before a human is asked to approve.
Outcome
Production-ready rule
Self-tested SQL, evidence map and severity — deployable to continuous monitoring with one human sign-off.
— Capabilities
RCM · / 01
Describe a process or upload a policy — the AI drafts a full Risk & Control Matrix mapped to SOX, ISO, NIST or your custom framework. Auditors refine and approve.
— What you get
— Responsible AI
01
Every AI output lands as a draft. Reviewer approval is mandatory before anything is published or executed.
02
Outputs are grounded in your engagements, evidence, controls and policies — every claim links back to the source.
03
Every prompt, output, source and approval is immutably logged — so AI itself is auditable end to end.
// Customer-managed keys · Tenancy isolation · No training on customer data
See the AI Studio live →