The problem
Your pilots are not dying because the AI is incapable.
They are dying because nobody can answer the questions that matter in a regulated firm. This page is the argument in full, written to be forwarded to the people who have to be convinced.
The situation
Everybody wants it. Nobody has deployed it.
The board wants AI. The advisors want AI. The vendors are everywhere, and the demos are genuinely impressive. And almost nothing is in production, because compliance and regulatory oversight cannot sign off.
If you run an advisor platform, you have probably had two pilots killed in review already. Not on capability. On the three questions nobody could answer: what did it actually do, who authorized it, and can you prove it.
Those are not unreasonable questions. They are the questions a firm has to answer about any process that touches a client. The problem is that the tooling built for AI was never designed to answer them.
The category error
The market is trying to solve this at the prompt.
Prompt policies. Output filters. Chat monitoring. Every one of those controls sits at the top of the funnel, watching the instruction go in and the text come out, and misses the entire middle.
What the controls assume
One prompt is one action. Review the request, review the response, and you have reviewed the system. This holds for a chatbot, which is why it became the default.
What actually happens
A single instruction fans out into capabilities, tool calls, data access, model delegations and document generation. Dozens of consequential steps, each one able to touch client data or produce something a client will read.
- 1instruction
- What the advisor actually typed.
- 7capabilities
- Distinct capabilities the instruction reached.
- 30tool invocations
- Calls out to data, models and renderers.
- 45material actions
- Each gated before it ran, bound to evidence after.
Illustrative of one observed run: a single research instruction reaching seven capabilities, thirty tool invocations and forty-five material actions, producing a finished twelve-slide analytical report in about sixteen minutes, for under a dollar. Every one of those forty-five actions was checked before it ran and bound to signed evidence after.
Compliance risk does not live in the prompt. It lives in everything the prompt causes.
Monitoring the one instruction at the top would have governed none of those forty-five actions. It would have produced a log entry showing that somebody asked a reasonable question, and told you nothing about the thirty times the system reached out for data or the document it put in front of a client at the end.
This is why review keeps failing. Your compliance team is not being obstructive. They are correctly identifying that the control does not cover the risk, and they are right.
And that is one instruction, from one advisor, once. The direction of travel is teams of agents generating work like this continuously, across every workflow in the firm. Sampling will not work, and neither will reading transcripts. Governing at the level of the individual action is the only model that survives that world, and the only one that gets easier as adoption widens rather than harder.
What it looks like when the answer is missing.
None of the following requires the AI to have done anything wrong. They follow from not being able to show what it did.
The lookback
A review turns up client-facing material the system produced without required language. The exposure is not that one document. It is every piece the system produced in the same period, because nothing distinguishes them.
The record that is not a record
An examiner asks how a recommendation was arrived at. A chat transcript shows what somebody typed. It does not show which data was pulled, which model answered, or what policy was applied at the time.
Supervision that cannot keep up
The firm has to evidence review of client communications. The system generates them faster than a sampling-based process was ever designed to cover, so coverage falls without anybody deciding that it should.
Reconstruction
Remediation means rebuilding months of activity by hand, from logs that were written for engineers rather than examiners, while the program sits frozen and the budget is already spent.
The cheapest moment to answer these questions is before the work runs, not after somebody asks.
In regulatory terms
Supervision attaches to the communication and the action.
Not to the prompt. Nothing in the rulebook contemplates an instruction typed into a chat box, which is exactly why governing the prompt governs nothing a regulator cares about.
When a pilot dies in review, it is rarely because someone disliked the technology. It is because a specific exposure could not be closed:
- FINRA 2210 exposure on anything client-facing the system produces.
- SEC Marketing Rule exposure the moment output reaches a prospect rather than a client.
- Books-and-records questions nobody in the room can answer.
- Supervisory review processes that cannot scale to the volume AI generates.
Each of those attaches to a thing the system did: a document it produced, a figure it cited, a disclosure it did or did not insert. None of them attach to the sentence that set the work off.
What an examiner asks for
- Show me this communication and the review it went through.
- Show me the record of what the firm did and when.
- Show me the policy that was in force at the time.
A prompt log answers none of these. An action-level record answers all three.
The only governance model that survives examination is one that gates and evidences every material action.
What that requires
Govern the graph, not the request.
01
Every action is a decision point
Each material action is evaluated against policy before it executes. Not sampled, not reviewed afterwards. Before.
02
ASK is a real outcome
A system that can only allow or block will be configured to allow. The third state, stop and ask, is what makes the first two honest.
03
Evidence is bound, not logged
Every action is tied to signed evidence of what ran under which policy. A log can be edited. A signed trace is a different kind of object.
That is what we built, and it is why these agents can be deployed where every other AI has stalled.
Forward this page to the person who said no.
It was written for them. If the argument holds, the next conversation is a demo with your compliance officer in the room.