ASP — Deterministic AI Control & Evidence for Regulated Finance

Deterministic control & evidence infrastructure

Prove what the AI was allowed to do.
Then it ships.

Your team can build the agent. What it can't do is prove, on paper, what the agent was allowed to do — so the deployment sits in security review. ASP is the layer that produces that proof. It sits between your AI and the money, treats the model as untrusted, and signs a record of every decision it makes.

Book a technical briefing Verify an evidence record →

Deployed inside your perimeter · Bring your own LLM · Offline-verifiable evidence · Fail-closed by default

Decision record · redacted SIGNED

decision      DENY
reason_codes  ["egress.destination_not_allowlisted"]
policy        pol_payments · 2026.07.3
signature     ed25519:9f3a…c721
prev_hash     4d81…0ba9
…

One record per decision. Hash-chained, Ed25519-signed, verifiable offline with the public key.

The problem

The controls exist. The chain that connects them does not.

Banks and fintechs now use AI everywhere except where the money moves. The checks are all there — IAM, gateways, filters, someone signing off in a meeting. None of them answers the question security review actually asks.

The model sits inside the trust boundary

The prompt, the output and the agent's decisions are all treated as trusted parts of production. So one injection turns into a real action: a tool call nobody granted, an endpoint nobody approved, another tenant's data.

Policies live in documents, not in runtime

Approvals are procedural rather than technically enforced. Between “the policy forbids it” and “the system will not permit it” lies the entire difference a control exists for.

Log completeness cannot be proven

After an incident, someone spends days matching records by hand across the app, IAM, the gateway, the model and the policy system. Whether that picture is complete comes down to the word of the team that assembled it.

The problem

The chain nobody can produce

Checks are already spread across IAM, API gateways, content filters, manual approvals and SIEM. Each answers one question. What does not exist is a single record that answers all five, in order, for one specific action:

Who initiated the action

The authenticated actor and the tenant they were bound to.

Which policy applied

The exact policy, at the exact version, in force at that moment.

What the model proposed

The normalized action requested, before anything executed.

Who approved it

The human approval, bound to that action and not to a category of actions.

Which endpoint was called

The destination actually reached, and whether it was permitted.

Until this chain is produced automatically, every AI use case in a regulated institution stops at security review — not because it was judged dangerous, but because its safety cannot be demonstrated.

Cost of the gap

Supervision has moved from guidance to penalties.

In the last twelve months, all three regions our clients work in raised both the size of the fines and how often they hand them out.

UAE AED 380m+

Imposed by the CBUAE across 31 financial institutions in the first eight months of 2025, 13 of them exchange houses

The administrative fine ceiling rose from AED 200m to AED 1bn — Federal Decree-Law No. 6 of 2025, in force from 16 September 2025

Personal liability: a branch manager fined AED 500,000 and permanently banned from the sector

EU €7.1bn

GDPR fines cumulative since 2018, as reported for 2025

443 breach notifications per day, up 22% year on year — above 400 for the first time since GDPR took effect

From December 2026 the AI Act applies in full to high-risk systems: a second liability layer on top of GDPR

Liability does not pass to the vendor

The FTC and the EEOC have confirmed that buying a third-party AI tool does not transfer liability to the party that sold it

The FTC pursues AI cases under Section 5 of the FTC Act, with no AI-specific statute

November 2025 — 42 state attorneys general signed a joint letter to AI companies

Sources: DLA Piper GDPR Fines and Data Breach Survey, January 2026 · CBUAE enforcement reviews for 2025 · Federal Decree-Law No. 6 of 2025 · FTC and EEOC materials

Where that bill lands inside the institution

A fine is the worst case, and it's rare. The money actually leaves earlier and more often, in three places — and in each one you either have the evidence or you don't.

DELAY

±$0.9m

One use case waits in security review. Every month it waits, the revenue or the saving waits with it — and the length of the wait has nothing to do with the risk. It's the missing paperwork.

ASP

A signed evidence pack is presented on entry to review, not assembled for it

INCIDENT

$250–750k

One AI action nobody authorised: the investigation, the log archaeology across four systems, the customer notification.

ASP

The decision trail is reconstructed from a signed hash chain, verifiable offline

IN-HOUSE

$600k–1.2m

You build the control and evidence layer yourself, once, for yourself — then maintain it forever with the same team that audits it.

ASP

A control layer as a product, with versioned policy and an independent artifact

The 1% problem

A 99% guardrail is a great model and an unacceptable control.

Guardrail vendors quote accuracy as a detection rate. In most industries the leftover 1% is a support ticket. In finance it's a payment that went out, a customer record that leaked, or a call you have to make to your regulator.

Accuracy is not a control

A detection rate is a statistical property of a model. A control is a rule that cannot be bypassed. Security review asks for the second one.

The number moves against you

That number drops with every model update, new prompt, new language and clever rephrasing. Nobody is re-certifying a filter on every release.

And it produces no artifact

Even when the filter is right, it leaves a score — not a signed record of which policy applied and who approved the action.

CONTROLLED ACTIONS PER MONTH

30k240k

A 99% GUARD PERMITS, UNREVIEWED

{{ residualPerDay }} actions into production every day

In a payments path, that is not a residual — it is a monthly incident schedule.

This is why a probabilistic guard never gets production access in a regulated institution — and why ASP puts a deterministic gate, not a better model, in front of the money.

Why now

Three curves cross in 2026

AI systems started acting, not answering

Agents now call tools, move money, update records and read customer data. A model mistake stopped being a bad answer and became a real event.

Enforcement arrived

The EU AI Act, GDPR, UAE PDPL, the DIFC and ADGM regimes and your sector rules all now expect controls you can demonstrate. Not controls you can describe.

Audit expectations moved faster than tooling

Auditors already ask for the decision trail behind an automated action. Today's AI stacks simply can't produce one.

Every regulated institution deploying AI will need an enforceable control boundary and a portable proof. Today each one builds it internally, once, badly.

Architecture

ASP sits between the AI system and production — and does not trust the model.

The model, the prompt and the output are all treated as untrusted input. What tools can be called, what routes can be reached and which policy applies is decided by a runtime the model has no way to influence.

That runtime runs inside your perimeter. Prompts, outputs, traces, records and keys never leave it. The hosted control plane only ever sees metadata — and you can drop it from the deployment entirely.

CONTROL PLANE (METADATA ONLY) Policy distribution · versioning · health — optional in the deployment

UNTRUSTED

Your AI systems

Prompts · model outputs · agent decisions

ASP RUNTIME · YOUR PERIMETER

Deterministic gates · evidence writer

Identity · capability · policy · approval · egress. Fails closed. Writes one signed record per decision.

PRODUCTION

Tools · routes · records

Customer data · payments

DEPLOYMENT

Your format

GATE EVALUATION

In the request path

ON UNAVAILABILITY

Fail-closed

DATA

Stays in your perimeter

The mechanism

Five gates. Every one deterministic.

Each gate is a rule that runs in the request path. Nothing probabilistic gets to say yes anywhere in the sequence, and anything that fails defaults to no.

01 Identity & tenant The actor is authenticated, the request is bound to a tenant, signed, and protected against replay. +

Reaching another tenant isn't forbidden by policy — it isn't possible. Every request carries a signed identity tied to one tenant, and anything replayed or unbound is rejected before policy is even read.

02 Capability Is this action within the capabilities granted to this specific agent? +

Each agent gets a short, explicit list of what it may do. Anything not on the list is denied without discussion — nothing is allowed by default and nothing is inherited.

03 Policy Versioned policy evaluation against tool, route and pattern allowlists. +

The version that applied is written down with the decision. A year later you can review that decision against the rules that were actually live at the time, not against today's.

04 Approval Critical actions are bound to a human approval on the exact action hash. +

An approval covers one action, not a category, and can't be reused on a different one. Who approved it travels with the record.

05 Egress Allowlisted destinations only. +

If a destination isn't on the list, the route doesn't open. And if anything upstream breaks — control plane unreachable, a check that won't finish — the answer is still no.

RUN A REQUEST THROUGH THE GATES

Pick a request and watch it go through. The gates run in order and stop as soon as the answer is settled — the same sequence the runtime runs.

01 Identity & tenant signed · tenant-bound · replay-checked {{ g1 }}

02 Capability granted capabilities for this agent {{ g2 }}

03 Policy evaluated against policy version 2026.07.3 {{ g3 }}

04 Approval bound to action hash {{ g4 }}

05 Egress allowlisted destinations only {{ g5 }}

RECORD WRITTEN {{ outcome }} {{ outcomeReason }} signed · chained · offline-verifiable

ADVISORY SIGNAL · SUBORDINATE

Optional LLM verifier — an independent semantic signal

Catches paraphrased or obfuscated instructions. It can raise risk to review or block.

It can never override a deterministic block, and never open a production route.

The Evidence Pack

What an auditor opens

After every decision ASP writes reason codes, a decision hash, component and policy versions, an Ed25519 signature, and a link into an append-only hash chain. Any holder of the public key can validate the chain offline — without contacting us, and after we are gone.

Every record contains

Request, tenant, actor

Normalized action

Model, provider, adapter

Policy ID and version

Reason codes and gate decision

Verifier signals and approval reference

Result hash and linked incidents

Sequence number, previous hash, signature

evidence_record.json · redacted

{
  "seq": 184203,
  "ts": "2026-08-11T09:14:22.418Z",
  "tenant": "tnt_7c1e…",
  "actor": { "type": "agent", "id": "agt_payments_ops" },
  "action": { "tool": "payments.transfer.create",
              "route": "api.psp-eu.example/v2/transfers",
              "hash": "sha256:1b90…e4af" },
  "model": { "provider": "<byo>", "adapter": "adapter_v3" },
  "policy": { "id": "pol_payments", "version": "2026.07.3" },
  "gates": { "identity": "PASS", "capability": "PASS",
             "policy": "PASS", "approval": "PASS",
             "egress": "DENY" },
  "decision": "DENY",
  "reason_codes": ["egress.destination_not_allowlisted"],
  "verifier": { "enabled": true, "risk": "low", "authority": "advisory" },
  "approval_ref": "apr_9d20…",
  "prev_hash": "4d81…0ba9",
  "signature": "ed25519:9f3a…c721"
}

Verify it yourself

The script and the public key sit at a stable URL. Checking a record never touches anything of ours.

# Verify a record and its position in the chain, offline
asp-verify --pubkey asp_pub.pem --chain evidence_2026_08.jsonl

THE HONEST BOUNDARY

What this proves is that the controls you specified ran as specified, on one particular action, under a known version of your policy.

It does not explain why the model wanted to do it — this is not SHAP or chain-of-thought. And it is not a compliance certificate. We give you the controls and the evidence; being compliant is still your job, and anyone who tells you otherwise is selling you a finding.

Deployment & data residency

Deployed inside your perimeter. Your model, your data, your keys.

Self-hosted runtime

One runtime per production deployment, in your own infrastructure. Nothing in the enforcement path needs to reach us. If our control plane goes dark, your runtime keeps enforcing the last policy it received — and keeps failing closed.

Bring your own model

An adapter layer keeps us provider-agnostic: your LLM contracts, your routing, your regional constraints. And no lock-in to one foreign model provider — which, in much of regulated finance, is a procurement requirement rather than a preference.

Control plane sees metadata only

Policy distribution, versioning and health. Optional in the deployment.

WHAT THE HOSTED CONTROL PLANE NEVER RECEIVES prompts · model outputs · traces · evidence records · signing keys · customer data

Competition

Everyone filters. Nobody proves.

We don't replace your identity, gateway, monitoring or governance tooling. We add the one thing none of it was built to do: decide, at runtime, what an AI action is allowed to do — and leave a signed record of the answer.

LAYER

WHAT THEY DO

WHAT IS MISSING

LLM guardrails / firewalls

Probabilistic input and output filtering

No enforceable authority, no audit artifact

IAM / API gateways

Human and service identity, route control

No awareness of AI actions, capabilities or model context

SIEM / observability

Post-hoc log aggregation

Detection after the fact, no prevention, no signed chain

AI governance / GRC

Inventories, assessments, documentation

Documents, not runtime enforcement

ASP

Deterministic runtime authority + signed, offline-verifiable evidence

—

We are complementary to IAM and SIEM. What we compete with is the assumption that filtering is enough.

Compliance mapping

What the ASP record actually satisfies

Each artifact the runtime produces answers a specific requirement. None of it is a compliance certificate — it's the material a supervisor asks for first.

EU AI Act GDPR UAE PDPL DIFC DP Law ADGM DP Regulations VARA Sectoral financial-services requirements

ASP ARTIFACT

REQUIREMENT

WHAT IT SATISFIES

Automatic event logging across the lifecycle

EU AI Act, Art. 12 · Deployer obligations, Art. 26

The log is produced by the system, not assembled by hand after an incident

Human approval bound to the action hash

EU AI Act, Art. 14

Human oversight is provable by person and by action, not asserted in a policy

Signed chain, verifiable offline

GDPR, Art. 5(2) — accountability · ISO/IEC 42001

The ability to demonstrate controls rather than describe them

Incident reconstruction from the chain

UAE PDPL — breach notification · DORA — ICT incident reporting

Notification deadlines hold because the picture was captured at the time of the action

Data stays in the customer perimeter

UAE PDPL, DIFC and ADGM regimes — cross-border transfer

Prompts, outputs and records never leave the perimeter: no transfer arises

We supply the controls and the evidence. Compliance is something your organisation is, not something a vendor can sell you — your AI inventory, risk classification, lawful basis and policy content stay with you.

Who ASP is built for

CISO / Head of Security

Say yes to AI in production, against a boundary that's actually enforced and a trail you can hand to an auditor.

Head of AI / AI Platform

Get the use case through security review without narrowing the use case.

Compliance / Operational Risk

Proof that the controls you wrote actually ran — action by action, against a known policy version.

Platform & Security Engineering

A predictable runtime in your own infrastructure, with your own model, that fails closed.

Product status

Where the product is today

SHIPPED

Deterministic runtime: identity, tenant, capability, policy, approval and egress gates

Ed25519 evidence chain with offline public-key verification

Optional LLM verifier and a provider-agnostic adapter layer

Versioned evaluation suite: jailbreak, injection, unsafe tool use, PII leakage, hallucination, drift

IN PROGRESS

High-availability and multi-writer persistence

Encryption-at-rest profile, backup and restore drills

Evidence lifecycle and retention module

Today ASP is ready for a pilot in a single-writer setup, and enterprise hardening is what the team is working on. We'd rather say that on our own website than have you find it in a security review — and you get the full known-limitations document in the first technical call.

Why us

We did not find this problem in a market map. Our clients brought it to us.

We are Medici Expert — a legal and compliance practice for licensed fintech and crypto. We handle licensing, banking, regulator correspondence, and the security reviews that decide what reaches production.

WHERE WE SIT

On the compliance side of the table

MiCA in the EU, VASP in Switzerland, VARA in the UAE, MSB and FINTRAC in Canada, gaming and PIF regimes elsewhere — we have taken clients through these licences and through the reviews that follow.

WHAT WE KEPT SEEING

The same question, unanswerable

Clients with AI in the roadmap kept stalling at one question from their own security and compliance functions: prove what the AI was allowed to do. Nobody could produce that artifact — so the deployment did not ship.

WHY WE BUILD IT

Advice cannot close this gap

We could write the policy, but not enforce it at runtime. The missing piece was never a document — it was a gate in the request path and a signed record behind it. So we built the artifact we had been asked for.

Most AI-security vendors come from security engineering and learn the regulation afterwards. We came from the regulation, and know exactly which artifact ends the review — because we have spent years being the ones asked for it.

Design partner program

Bring one deployment stuck in security review.

We work with a handful of ADGM-, DIFC- and VARA-licensed institutions and EU fintechs putting AI onto production paths. A paid pilot runs 8–12 weeks on one route with live traffic. We judge it on one number: how long it took to get from security review to production.

What you get

Deployment of the ASP runtime in your environment, scoped to one AI use case — $15k for the pilot, credited against the first annual licence

Our engineers, directly — no support tier between you and the people who built it

Real influence over the policy model, the reason codes and the evidence schema

The full list of what doesn't work yet, before you commit anything

Better terms on the first production licence

What we ask

One real use case that's actually stuck in security review — not a sandbox

An early introduction to the reviewer who will assess us

Honest feedback while the pilot runs

If it works, a reference conversation — your terms, your timing

REQUEST RECEIVED

We reply within two business days. First conversation is technical, 45 minutes, no deck.

Work email Organisation Role The AI use case currently blocked

We reply within two business days. First conversation is technical, 45 minutes, no deck.

FAQ

Questions a security review will ask

Is this an LLM guarding an LLM?+

No. Every gate that can say yes or no is deterministic. The optional LLM verifier only advises: it can raise risk or block, but it can never overturn a block and never open a route.

What happens if ASP is unavailable?+

It fails closed. Anything that needs a gated decision gets denied, not waved through. And if our control plane is unreachable, your runtime keeps enforcing the last policy version it received.

Do you see our prompts, model outputs or data?+

No. The runtime is inside your perimeter and the data stays there. Our control plane only handles policy distribution, versioning and health metadata — and you can drop it from the deployment.

Which models and providers are supported?+

An adapter layer keeps us provider-agnostic — you bring your own model and your own contracts. We'll walk through the current adapter list for your stack in the technical call.

How do we know the evidence has not been modified?+

Each record is signed with Ed25519 and carries the hash of the one before it, so changing any record breaks every signature after it. Anyone with the public key can check a record and its place in the chain offline, with a published script and no help from us.

Is this the same as AI governance tooling?+

No. Governance platforms inventory your AI systems, assess them and document how the controls are meant to work. We enforce at runtime and produce the artifact showing the control ran. The two sit side by side — plenty of our conversations start with a governance platform already in place.

Does ASP make us compliant with the EU AI Act / GDPR / PDPL?+

No. We give you technical controls and evidence that support obligations under those regimes. Compliance still depends on your governance, your risk classification and your policies. We publish the control mapping so your compliance team can see exactly where our line stops and theirs starts.

What are the current limitations?+

Pilot-ready in a single-writer setup; high availability and multi-writer persistence are still in progress. You get the full known-limitations document in the first technical call, before you commit to anything.

How long does integration take?+

A pilot runs 8–12 weeks end to end on one route with live traffic. We'd rather give you the range we've actually observed with design partners in the technical call than a reassuring adjective here.

How is it priced?+

An annual licence per deployment inside your perimeter: $75k for a fintech or VASP (one protected AI system, up to five controlled routes), $150k for a bank or payment institution, +$15k for each additional protected AI system. A $15k paid pilot precedes it and is credited against the first licence; first-year integration fee is $25k. Priced as infrastructure, not per seat.

The model is ready. The control is what is missing.

Bring one use case that's stuck. In 45 minutes we'll walk you through the gates, the evidence and the verification. Technical, no deck.

Book a technical briefing Download an Evidence Pack sample

Prove what the AI was allowed to do.Then it ships.