A governance checkpoint between every agent decision and its execution. Aureon implements the four SAFR components — Agent Identity, Controls Repository, Disposition Engine and Audit Log — so every autonomous action is authorised, evaluated and recorded before it reaches your bank's systems.
Model risk management assesses the model before it goes live. Audit reviews sampled transactions hours after execution. Neither catches a problematic agent decision before it executes. When agents move from recommendation to autonomous action, governance has to move to runtime.
MRM is calibrated to pre-deployment. Audit is retrospective. By the time an issue appears in the log, the action has already occurred.
No standard for when a human should decide. Notifications, email alerts, dashboard flags — no defined deadline, no audit record. Oversight without substance.
Content filters and prompt defences reduce error classes at the model's output. They don't enforce structural, numerical or policy constraints on financial actions.
Four components. One Governance Envelope. Four defined outcomes. No agent action reaches execution without being declared, authorised, evaluated and logged.
Binds every proposed action to a registered agent. Verified against the registry before any other evaluation proceeds. Cryptographic identity, short-lived, tied to version and environment.
The institution's configurable rulebook. Authority. Exposure limits. Rate limits. Evidence quality. Regulatory constraints. Mandate-based delegation from the human principal.
Evaluates each proposed action deterministically. Resolves to one of four outcomes. Deterministic controls first — LLMs may assist interpretation but do not become the final authority.
Tamper-evident, append-only record of every governance decision. Reconstructs any action, any decision, without relying on the agent's account of what occurred.
Before an agent can execute, the proposed action is packaged in a Governance Envelope — action, action trace, context metadata. The envelope carries what the agent intends to do, how it reached that proposal, and the state of the world when it did.
Type: payment.initiate
Value: USD 45,000
Counterparty: registered vendor
Purpose: Q3 invoice
Tool calls: vendor.lookup, invoice.verify
Data: invoice_v3.pdf
Checks run: duplicate scan, sanction screen
Agent: treasury-payments-v2
Principal: CFO
Mandate: AP-2026-089
Balance: USD 1.2M
The Disposition Engine resolves every in-scope action to one of four outcomes, calibrated to the action's reversibility, materiality, customer impact, regulatory sensitivity and novelty.
Violates a hard regulatory or policy constraint, or exceeds a defined risk threshold. Rejected before execution. Reason recorded.
In scope, below hard constraints, but above the threshold for autonomous execution. Held pending human review — with a deadline, a record, and a defined reviewer.
Within scope, below hard constraints, within risk thresholds. Proceeds without human intervention. Fully logged.
Permitted to proceed but flagged. Executes while a structured observation is logged for subsequent review. Used for signals worth watching without blocking.
Not a log dashboard. A live control layer with intervention authority — revoke tools, reduce limits, escalate, activate kill switch.
Illustrative dashboard · Every disposition, escalation, override and kill-switch event is logged and reviewable.
SAFR supports two integration patterns. New builds get tighter governance; existing agents can be brought under governance without re-engineering them.
The agent emits a Governance Envelope before each proposed action. Aureon Runtime evaluates and returns a disposition before the agent takes any action. Tightest integration, most granular record, cleanest audit trail.
The Aureon gateway intercepts outbound API calls at the infrastructure layer, wraps each call in a Governance Envelope, and evaluates it — without any changes to agent code. Bring existing agents under governance without re-engineering.
SAFR patterns are already being deployed across financial services. Below: six representative implementations documented in the SAFR white paper — showing that the four-component model is not theoretical.
Digital Agent Passport for identity. Machine-readable mandates for authority. Circuit breakers at agent, principal or counterparty level. Ambiguous instruction → agent defaults to inaction.
Agentic Token bound to consumer-granted scope (merchant, amount, timeframe). Cryptographic identity binding to operator and end-user. Verifiable Intent framework for tamper-resistant authorisation records.
Passkey (FIDO biometric) confirmation → digital rule stored on the Visa network. Agent cannot modify limits; any excess is declined at the network layer. All key moments recorded by design.
Portable, verifiable identity on-chain (ERC-8004). Per-transaction and aggregate spending caps in policy layer. Compliance Engine screens against sanctions before execution. Append-only audit trail reconciled with on-chain settlement.
Narrowly-scoped source-of-wealth memo agent. Documents assessed, plausibility check by human at critical decision point. Standardised structured memo as the institution's record of the assessment.
Per-request adviser identity. Retrieval-controlled content. LLM-as-a-Judge evaluation against SME-curated answers. Out-of-scope or low-confidence → blocked or escalated. No autonomous execution into financial systems.
Source: SAFR white paper, July 2026. Aureon Runtime implements the same four-component pattern as a shipping product.
SAFR is not a replacement for guardrails or settlement compliance. It sits between them, at the runtime layer where the disposition happens.
Content filtering, prompt defences, model-output guardrails. Governs what the model produces.
Pre-execution governance. Envelope, identity, controls, disposition, audit. Governs whether the action may proceed.
Payment rails, SWIFT, card networks, ACH, core banking. Governs how value actually moves once submitted.
Aureon Runtime maps to SAFR component-by-component. See our SAFR explainer for details.
Aureon Control Plane is not a single monolith. It is composed of four bank-grade modules, each addressing one part of the runtime governance problem.
AI Registry and Control Graph. Canonical inventory, authority model, dependency graph, shared platform objects. The identity substrate.
Control Intelligence. Converts regulation, policy and risk appetite into testable, enforceable controls. This is the Controls Repository.
Financial AI Action Control. Real-time disposition, tool gateway, human-approval pause, kill switch. This is the Disposition Engine.
Workflow and Recommendation Assurance. Inline control for copilots, workflow agents and semi-autonomous decisions — the mid-tier of oversight.
A control applies according to the action, authority and customer impact — whether the system is called a model, copilot, workflow or agent.
Third-party or black-box services receive narrower permissions, stronger monitoring and compensating controls. Explainability degrades authority.
Rules, policies, limits and approvals are enforced deterministically. LLMs may assist interpretation but do not become the final policy authority.
Every evaluation, approval, runtime check, override and outcome is stored in a reconstructable evidence chain — not reconstructed after the fact.
On-prem, bank VPC or hybrid. Production data does not leave the institution. No third-party AI calls in the control path.
Aureon consumes signals from model, observability, security and workflow tools — and converts them into financial action assurance.
| Guardrails / LLM safety | AI observability | Traditional MRM | Aureon Runtime | |
|---|---|---|---|---|
| Where it acts | Model output | Post-execution logs | Pre-deployment | Pre-execution, at every action |
| Deterministic disposition | Probabilistic | Reactive | Not runtime | Deny / Escalate / Auto / Observe |
| Kill switch / intervention | Logs only | Graduated: revoke tools → suspend → kill | ||
| Agent identity binding | Partial | Cryptographic, per-action | ||
| Governance Envelope | Signed and structured | |||
| SAFR-aligned | Component-by-component |
Runtime governance for AI agents. Lifecycle governance for classical models. Same audit trail, same evidence, same regulator-ready reporting fabric.
Two ways to start. No sales-cycle overhead. On your premises or in your VPC.