Governed by frameworks. Verified by audit trails.
OWASP Agentic AI Top 10 mapped. Privacy Act compliant. Every agent decision logged with full reasoning traces. Compliance is engineered into every agent we build — not retrofitted after deployment.
What we comply with.
Not a summary of what regulations exist — a mapping of what we actually do about them. Every framework listed here has specific controls implemented and evidence collected.
OWASP Agentic AI Top 10
Every risk mapped to a specific technical control
From 10 December 2026, Privacy Act amendments require any entity using automated decision-making that significantly affects individuals to disclose what personal information is used, what decisions are made by computer programs, and where computer assistance significantly influences outcomes.
This is built into every agent deployment that touches personal data — not an optional add-on.
Sandboxed privilege rings.
Agents operate in isolated execution rings inspired by CPU privilege levels. No agent can escalate its own permissions. Every ring has independent policy rules, resource limits, and audit requirements.
User-Facing Output
Response generation, document creation
Tool Execution
API calls, database queries, file operations
Core Orchestration
Agent planning, memory access, prompt assembly
Agents cannot escalate from a lower-privilege ring to a higher one. Each ring has independent policy rules, resource limits, and audit requirements.
Contained. Controllable. Killable.
Agents operate in sandboxed execution rings inspired by CPU privilege levels. No agent can escalate its own permissions. Every agent has a kill switch. Every high-stakes decision requires human approval.
Kill Switches
Immediate agent termination at any layer. Kill switches are configured per-agent during the build phase and tested before every production deployment.
Circuit Breakers
Automatic throttling when error budgets are exhausted. SLO enforcement prevents degraded agents from continuing to operate. Automatic rollback on policy violation.
Saga Rollback
Multi-step agent operations use saga orchestration. If any step violates a policy rule, the entire operation rolls back automatically — no partial state.
Runtime Policy Engine
Every agent action — tool calls, data access, API requests, output generation — passes through the policy engine before execution. Policies defined in YAML, evaluated in under 0.1ms.
Principles with teeth.
Not aspirational statements — concrete commitments enforced at runtime. Every principle below has a corresponding technical control, not just a policy document.
Transparency
Every user-facing agent interaction includes a clear disclosure that they are interacting with AI. Handoffs to humans are clearly communicated. AI-generated recommendations are labelled as such.
Explainability
Reasoning traces captured for every decision. Confidence scores on outputs. "Why this recommendation" explanations available for medium and high-stakes decisions.
Bias Mitigation
Structured approach across four phases: bias review during design, diverse test scenarios during testing, output auditing during pilot, and ongoing fairness metrics tracking in production.
Contestability
Every agent decision affecting an individual includes a pathway to request human review. The client defines who handles contested decisions. Full decision audit trails are available for review.
Model Governance
Pinned model versions — never "latest". Scheduled drift evaluation suites. Multi-model strategy documented per agent. Prompt versions tracked alongside model versions in every audit record.
Decision traces, not just logs.
Standard application logs are not sufficient for AI compliance. We capture cognitive decision traces — the full reasoning chain, not just the inputs and outputs. Every intermediate step, tool call, and decision point is recorded.
Captured per agent execution
Built on OpenTelemetry. Exportable to your SIEM or observability platform — Splunk, Datadog, Azure Monitor, and Google Cloud Logging supported out of the box.
These traces directly satisfy Privacy Act automated decision-making disclosure requirements and provide the evidence base for APRA model risk governance.
Your data stays yours.
We never own client data. We never train on client data. Every byte stays in your cloud account, in your region, under your control.
For full technical security controls — encryption, network isolation, authentication, and infrastructure architecture — view our security page.
Before we write a line of code.
Every engagement starts with a structured compliance checkpoint. We map your regulatory obligations, classify your data, and configure governance controls — so your compliance team has confidence before development begins.
Compliance Onboarding Checklist
Run for every engagement. No exceptions.
Need our security pack?
Architecture diagrams, compliance documentation, and security questionnaire responses — available on request.
Compliance shouldn't slow you down.
Walk through your regulatory requirements with our team. We'll map what applies and build it in from day one.