An auditor asks who approved an action, what data the agent touched and what stopped a bad output. We build those answers into the system itself: guardrail agents, second-agent checks, human approval gates and a log of every step, running in your own cloud.
Jason, our COO, runs the call and the AI Audit.
Purchase order read, finance agent
AllowedPayroll ledger read, finance agent
Denied by roleDraft checked, second agent, rule set v12
ApprovedPayment proposal sent to approver in Slack
HumanEach one is code your engineers can inspect and your auditors can test.
Agents take their permissions from the systems they read, so a finance agent cannot open payroll because someone forgot a filter. Every retrieval is logged with the agent, the source and the result, in your enterprise context layer.
A guardrail agent screens every input for prompt injection, and a second agent checks each draft against your business rules before anything leaves the system. The same gates run on our enterprise AI chatbots.
A payment, a refund or a contract change above the threshold you set waits for a named approver. Each workflow has an owner and an escalation path before it goes live.
Workflows move through development, pre-production and production, and errors alert your team in Slack and by email. Our AI managed services keep the controls current as models and data change.
Two production systems where the governance is part of the build, each written up on its case page.
Every figure on an IES alert card is a database value. A verification step names any figure the model was not handed, and every threshold change is recorded with who made it, from when and to when.
B2B e-commerce, chat agentA separate triage agent reads each finished chat and creates the ticket the chat agent promised. A Gatekeeper agent sends back any draft that breaks a rule, for up to ten rewrites.
Governance starts with the decision to use AI for a process. The ACT-IAC AI Playbook scores a candidate process with a questionnaire and reads the total in three bands. We use it as a first filter, then test what passes against your data in the AI Audit.
Small return and limited applicability. Usually fix the process without AI.
AI can be supported, but a traditional approach may suit better. Needs the deeper analysis an audit gives.
Strong return and strong applicability. A candidate for the roadmap.
Source: ACT-IAC, AI Playbook for the U.S. Federal Government (January 2020), filed with NIST. The playbook treats the total as a preliminary guide.
The same ACT-IAC playbook separates bias into three types. Treat them as one problem and at least one goes unmanaged.
Someone shapes the input or the data to make the system disadvantage people. A guardrail agent on every input, role-scoped access and a log of who changed what stop it.
It is the most common type, and it comes from a gap nobody tested for. Test sets built from your real cases, a second-agent check on every output and monitoring after go-live catch it.
These are limits set on purpose, such as safety thresholds. We write them as explicit business rules with an owner, so someone reviews them.
Your legal team decides which obligations apply. We turn each one into a control that runs in the workflow and leaves evidence behind.
| Rule | What it asks for | Control in the build |
|---|---|---|
| Colorado AI Act (SB 24-205) | Disclosure and impact assessments for high-risk AI systems | A use-case register with a risk rating per workflow, and logs of how each decision was made |
| California AB 2013 | Transparency about training data | A record of which sources each agent reads, from the context layer |
| Texas TRAIGA | Penalties of $10,000 to $200,000 per violation | Human approval on consequential actions, and a log that shows it happened |
| EU AI Act | Risk assessment and categorisation of AI use cases | A risk category per use case, set in the audit before anything is built |
State laws summarised from FTI Consulting's review of U.S. AI regulation. We do not give legal advice.
| What you get | |
|---|---|
| You receive | Controls running inside your workflows |
| Audit evidence | A log of every retrieval, check and approval |
| Human oversight | Approval gates with a named owner per workflow |
| Where data runs | Self-hosted n8n in your own cloud |
| After go-live | Error alerts and managed monitoring |
The AI Audit decides which processes should use AI and sets a risk category for each use case. The build writes the controls into every workflow: inherited permissions, guardrail and second-agent checks, approval gates and a log. Our AI managed services keep those controls current after go-live. Your legal team decides which obligations apply, because we do not give legal advice.
The ACT-IAC score gives a first read, then the AI Audit tests the candidates against your data and returns ROI models for your top three to five initiatives and a ranked 90-day roadmap. To start with your data, workflows and team, see the AI readiness assessment.
Yes. Every retrieval, check and approval is written to a log in your own environment. Agents read your systems through their APIs with the permissions those systems already enforce, and our healthcare context layer article walks through the design for protected health data.
The ones your legal and compliance team says apply. For North American clients these often include the Colorado AI Act, California AB 2013 and Texas TRAIGA, and for European operations the EU AI Act and GDPR. We build the controls, approval gates and logs that let your team show each obligation is met.
Yes. A policy says what people may do, and the controls enforce it inside the system. Our AI use policy template is an editable starting point covering data, tools and human review.
It depends on how many workflows you run and how many systems they touch, so we scope it before we quote it. The AI Audit takes 4 to 8 weeks and costs $10,000 to $100,000, with the fee credited toward your first build. After that, the controls ship with each workflow.
Answer a few questions about your team and what you want automated, then Jason scopes it with you on the call.
