The auditor asks about the case, not about the model.
This is why we describe AI control and audit in practice: who is accountable for changes produced with AI involvement, what stays in the audit trail, and where the AI agent operates.
What you can verify in an AI audit
Who approved the change
Every change comes with evidence and the human who approved it.
What stayed in the audit trail
Agent actions are attached to the case in which they were performed and recorded in its history alongside human activity: as a result, it is clear who did what, when, and in which channel.
Where the agent operated
Within the bank’s infrastructure, on a model chosen by the bank.
Who decides what the output means
Whether an agent’s output is a decision or a proposal is determined by the bank.
Security built into the Eximee platform
Instead of policing the security standard across teams, agents, and repositories, the bank maintains a single runtime that enforces it on every run.
Safeguards, validation, access control, logging, and audit are built into the platform rather than added in individual applications, so security and compliance testing covers an entire class of solutions. Metrics, logs, and process traces from many applications also flow into a single monitoring model.
What the low-code platform provides
Platform
Key decisions, such as session, permissions, and integrations with the bank’s channels, are locked in by the Eximee runtime, the platform’s execution environment. A business application, including one generated by an agent, can use them but cannot change them. The platform also accepts only known element types, so any output outside that set will not pass import.
Human
Reviewing business applications built on the platform requires less specialist knowledge than reviewing code written by an agent, as the reviewer evaluates the business logic (the process, forms, and rules) rather than the security mechanisms, which the platform provides. It is also easier to stay consistent with the architectural decisions made when the platform was deployed at the bank.
Questions to ask every AI vendor
We answer these questions transparently.
Frequently asked questions
Can the agent make a change on its own?
No, every change made with an agent’s involvement comes with evidence and a human who approved it.
Where does an audit start when checking the agent’s work?
An audit asks about the case, so the starting point is the process in which the agent operated.
Where does the agent run, and who chooses the model?
The agentic step runs in the bank’s infrastructure, and the bank chooses the model. This also applies to environments with no outbound traffic.
Who decides whether the agent’s output is a decision?
The bank. That question stays on its side.
