Know, Do, Prove

A simple model for governing AI agents in relationship-led banking.

Know: Every data source has an owner, a classification and clear access rules.
Do: AI agents act only within a defined mandate, with human approval for higher-risk actions.
Prove: Every agent action produces a tamper-evident evidence receipt for the audit trail.

Know

Information governance

Each data source is catalogued with a data owner (the person accountable for it), a classification (how sensitive it is), lineage (where it comes from), freshness and permitted purposes. Access is set by role. Select a role to see what is visible, masked (sensitive fields hidden) or access denied. Note that the AI agent sees less than a human Relationship Manager.

View as role

Do

Agent governance

Every AI agent is registered like a member of staff. It has a mandate (what it is for), allowed tools, data scopes (which sources it may use), an autonomy level, a named human approver, a risk tier and hard limits. Select an agent, choose a request and run the policy checks (automatic rule checks before anything happens).

Simulate a request

Human approval required:

Prove

Evidence receipt

Each agent action produces an evidence receipt: what was asked, by whom, which data was used, which policies were checked, who approved and what the agent produced. The receipt ID is a hash, a digital fingerprint of the full contents. If any detail is altered, the fingerprint no longer matches, so the record is tamper-evident. Edit any field below, then select Verify receipt.