Bulwark: Every AI Decision Proven Before It Runs
Most AI governance stops at the policy layer — a document that says what should happen but cannot prove what did happen. Bulwark is a runtime guardrail control plane that inspects every AI decision through ten stations before and after model execution, producing a SHA-256 hash-chained evidence trail with seven nuanced outcomes beyond binary allow/block.
In June 2026, a European bank deployed an internal AI assistant to help relationship managers draft client communications. Within three weeks, the assistant recommended a structured product to a retail client that violated MiFID II suitability requirements. The recommendation was factually coherent, grammatically flawless, and completely prohibited. No one caught it until the client's complaint reached the regulator.
The bank had a policy. The policy said AI outputs involving regulated advice must be reviewed before delivery. But the policy existed as a PDF on a SharePoint site. It had no mechanism to inspect the AI's output before it reached the client. No mechanism to verify that the suitability check had occurred. No mechanism to prove — to a regulator holding a enforcement notice — that the control had been applied to this specific request at this specific moment.
This is the gap that Bulwark is built to close.
The problem with policy-layer governance
The dominant model for AI governance in 2026 is the policy layer. An institution writes an AI use policy. It defines acceptable use categories, risk tiers, prohibited applications, and human oversight requirements. It may even map to regulatory frameworks — EU AI Act, NIST AI RMF, ISO 42001.
And then the policy sits in a document management system while AI agents make thousands of decisions per day.
The distance between the policy and the decision is the attack surface. Not for external adversaries — for institutional failure. The model hallucinates a compliance-sensitive output. The agent accesses data it should not classify at that sensitivity level. A request that should require human review passes through unreviewed because no system enforces the review requirement at runtime.
Policy-layer governance answers the question what should happen? It does not answer the question what did happen? And when the regulator, the auditor, or the board asks for proof, the institution discovers that a policy without enforcement is a statement of intent — not a control.
The gauntlet
Bulwark is a runtime guardrail control plane. It sits between the user and the model — every request passes through it, every response passes back through it. Nothing reaches the model unchecked. Nothing leaves unverified.
The architecture is a ten-station inspection pipeline — six pre-flight checks before the model executes, four post-flight verifications after.
Pre-flight
S01 — Identity & Purpose. Before the request reaches any model, Bulwark authenticates the caller, classifies the intent, and screens for prompt injection. The question is not is this a valid user? — it is is this user authorized for this type of request, and is the request itself clean?
S02 — Data Classification. The request content is scanned for sensitivity. Token-level redaction is applied before model exposure. A request containing client account numbers, proprietary trading strategies, or board-level deliberations is not the same request as a general knowledge query — and it should not be treated the same way.
S03 — Personal Data & Secrets. Credential scanning, PII detection, and secret masking. This is distinct from data classification because PII and secrets have their own regulatory obligations — GDPR, CCPA, bank secrecy — that operate independently of business sensitivity.
S04 — Manipulation. Adversarial prompt screening, jailbreak pattern detection, and social engineering vector identification. The threat model here is not the external attacker — it is the well-intentioned user who has learned that certain prompt patterns bypass controls, and the automated agent whose context window has been poisoned upstream.
S05 — Model Authorization. Tier-based model access controls and deployment region enforcement. Not every user should access every model. Not every model should process every data type. And in jurisdictions with data sovereignty requirements, the model must execute in the correct region — not wherever the cloud provider's load balancer sends it.
S06 — Spend & Rate. Budget gates, token-rate throttling, and cost attribution. This is the station that prevents the single runaway query from consuming a quarter's AI budget, and ensures that every token spent is attributable to a business unit, a use case, and a human.
Post-flight
S07 — Grounding. After the model responds, Bulwark verifies factual accuracy and manages data-sovereignty rerouting. A response that cites a regulation should cite the correct regulation. A response that references client data should reference data the model was authorized to access.
S08 — Regulated Conduct. Screening for fair lending violations, bias indicators, and prohibited advice categories. This is where the MiFID II suitability failure would have been caught — not by a human reviewer reading every output, but by a control that screens every output against the institution's regulated conduct rules.
S09 — Disclosure. Consequential decisions are escalated to human-in-the-loop reviewers. Not every AI output requires human review — but every institution must define which outputs do, and the system must enforce that definition at runtime.
S10 — Human Oversight. Final accountability gating and audit seal application. The named human accountable for this decision is recorded. The seal is applied. The evidence chain entry is written.
Seven outcomes, not two
Most guardrail systems produce binary outcomes: allow or block. This is insufficient for enterprise operations.
A request that contains PII should not be blocked — it should be redacted before the model processes it, and the redaction should be recorded. A request that violates data-sovereignty requirements should not be blocked — it should be rerouted to the correct regional deployment. A request that exceeds spend thresholds should not be blocked — it should be queued pending budget authorization. A request that triggers regulated conduct rules should not be blocked — it should be held for review by a named human reviewer.
Bulwark produces seven verdict outcomes:
- Allowed — request proceeds unmodified.
- Redacted — sensitive content masked before model processes.
- Rerouted — redirected to alternative deployment.
- Queued — held pending resource availability or policy window.
- Held for Review — requires named human reviewer approval.
- Blocked — request rejected entirely.
- Halted — system-wide traffic stop requiring dual-signature resume.
Each outcome is a specific operational response with a specific audit requirement. A block is not the same as a halt. A redaction is not the same as a reroute. The evidence chain records exactly which outcome was applied, by which station, under which policy version, at which timestamp.
The evidence chain
Every verdict, hold, release, policy deployment, halt, and resume is recorded in a SHA-256 hash-chained ledger. Each entry references the previous entry's hash — creating an immutable, tamper-evident sequence that cannot be rewritten without breaking the chain.
This is not a log file. Log files can be edited, truncated, or deleted. A hash-chained ledger is tamper-evident by construction. If any entry is modified after the fact, every subsequent hash becomes invalid. The integrity of the chain is mathematically verifiable.
Every entry records the previous hash, the current transaction hash, the verdict type, the station that produced it, the specific action taken, the policy version applied, and — for decisions involving human judgment — the identity of the human and the timestamp of their action.
The chain is exportable as JSON, CSV, or PDF. When the regulator asks can you prove that this control was applied to this decision? — the answer is not a policy document. It is a cryptographic proof.
Four executive lenses
The same evidence chain is read through four role-specific perspectives:
CFO — Financial. Token spend versus budget. Exposure avoided through control activation. Cost of operating the control plane. The CFO does not need to understand prompt injection — the CFO needs to know what the guardrails cost and what they prevented.
CAIO — AI Governance. The AI system register. Risk tiering. EU AI Act compliance mapping. NIST AI RMF alignment. The CAIO needs the evidence chain translated into governance language — which systems are high-risk, which controls are active, which regulatory requirements are met.
CTO — Architecture. Per-station latency at p50 and p99. Fail-closed posture verification. Policy-as-code version control. Deployment topology. The CTO needs to know that the control plane is not degrading system performance and that the architecture is sound.
CIO — Assurance. Control coverage. Chain integrity verification. Evidence export. Separation of duties validation. The CIO needs to attest that the controls are comprehensive, the evidence is intact, and the duties are properly separated.
Four executives, one evidence chain. No reconciliation required.
Regulatory crosswalk
Bulwark's ten stations are mapped to five regulatory frameworks — not as a compliance overlay applied after the fact, but as design constraints embedded per station:
- EU AI Act — high-risk AI system obligations.
- NIST AI RMF — AI risk management alignment.
- SR 11-7 — model risk management standards.
- BCBS 239 — risk data aggregation and reporting.
- ISO 42001 — AI management system requirements.
When a station applies a control, the corresponding regulatory mapping is recorded in the evidence chain. The institution does not need to maintain a separate compliance tracking system — the compliance evidence is produced as a byproduct of the control itself.
The institutional question
The question that Bulwark answers is not do we have an AI policy? Every institution has an AI policy by now. The question is can we prove that our AI policy was enforced on this decision, at this moment, by this control, with this evidence?
That is the distance between governance and proof. Policy says what should happen. Bulwark proves what did happen — every decision, every station, every verdict, every hash.
Bulwark is live and free to use.
Open the Portfolio Briefing → — the full portfolio mapped across seven institutional buyer lenses.
Richard Leclézio
Enterprise Transformation & AI Delivery Leader