Your partner bank will ask what your AI did and who approved it. Hand them a record they can check.
Coriqo keeps a record of what your AI agents and models did, who approved it, and proof that nobody changed it afterwards. When one steps outside what it was cleared to do, a finding opens and stays open until the fix is retested. Your sponsor bank, enterprise customer or auditor checks the record on their own machine, without taking your word or ours.
Don’t trust us. Check.
Someone outside your company is going to ask you to prove it.
A policy document says what should happen. When AI makes credit, fraud or payment decisions, the people who carry your risk want to see what did happen. They usually ask at the worst possible moment.
Their examiner asks them about your AI. They ask you, and they need an answer that holds up.
“Describe how you control what your AI agents can do.” The deal waits on your answer.
Not a description of your controls. Evidence that they ran, on the dates you say.
Who knew, when, and what was done. The first answer you give is the one everyone remembers.
Monitoring tells you something happened. Coriqo proves what happened next.
You probably already watch latency, drift and accuracy. That tells your team the model is healthy. It doesn’t show anyone outside your team that a control held, that the right person knew, or that the fix worked. That is the gap Coriqo fills, and it works alongside the tools you already run.
| Monitoring and governance dashboards | Coriqo | |
|---|---|---|
| The question it answers | Is the model up, fast and accurate? | Did the control hold, who knew, and was it fixed? |
| When something goes wrong | An alert on a screen | A finding with a named owner and a due date, closed by a passing retest |
| What an outsider receives | Screenshots and exports from the vendor’s system | A sealed record they check offline with a public key |
| Who they have to trust | The vendor, and whoever ran the export | The math. Not you, and not Coriqo |
| Who makes the call | Sometimes the tool | Always a named person. Coriqo flags and records; it never decides |
| Place in your stack | Often inline, as a proxy or gateway | Read-only. Never in your serving path, never a runtime dependency |
Start with the one that is costing you now.
We don’t ask you to buy continuous monitoring because that is what we do. Each of these is a specific failure with an owner and a cost. Pick one, prove it is handled, and add the rest when it earns its place.
An agent moved money it was never cleared to move.
What an agent may do (its mandate) is a reviewed, versioned record signed by a named person. When the agent calls a tool its mandate does not cover, a finding opens the moment it happens, and the alert reaches a person on the impact scale you set: PagerDuty, Opsgenie, Slack, Teams, email or a webhook.
You can show: the exact mandate version it broke, who was paged, and the minute they acknowledged.
Your sponsor bank’s review is next month.
Approvals, findings and fixes are already on one record, so the evidence package is generated from it, not assembled by hand. The reviewer gets read-only access that expires, and a proof bundle they run on their own machine with no network and no Coriqo account.
You can show: a dated package that either verifies or doesn’t. No “trust us.”
AI is running in your cloud that nobody approved.
A read-only role in your AWS account is the whole install. Coriqo lists what is deployed (SageMaker, Bedrock, artifacts in S3), compares it with what you govern, and flags the rest as ungoverned, with the account it sits in and the date it was first seen. Nothing in your account changes.
You can show: an inventory that was complete on a given date, not one rebuilt after someone asked.
Someone signed off what they shouldn’t have.
An approval sitting on an open critical finding, or a release after an unresolved threshold breach. Coriqo checks the record against itself, flags the contradiction with the evidence attached, and records whether you accepted or dismissed the flag, and why.
You can show: that a person reviewed the evidence before signing, not just that a signature exists.
2:14 AM. A payments agent tries a transfer it was never allowed to make.
The company, the people and the times are invented. Each step is something the product does today.
Coriqo flags the tool call against the mandate version Model Risk signed in March, and opens a finding.
An agent that can move money is a 10 on your impact scale, so this one pages a person now. A 3 would wait for the weekly digest.
The incident is acknowledged in your PagerDuty too, so nobody else is woken. Her name and the minute go on the record.
It can’t drift into next quarter’s log review.
The transfer tool is taken out of reach, the red-team test reruns and passes, and the owner closes the finding with a written reason.
“When did a human know?” Paged 2:16, acknowledged 2:21, fixed and retested by day 9. They check it themselves.
Diligence will ask whether your AI controls worked all year. Start the record now.
Before an IPO, a bank partnership or a large enterprise deal, your auditor or the team doing your diligence asks for evidence that your AI controls ran over the whole period they review, not that the controls exist today. A record only covers what was recorded at the time. It can’t be backfilled, so every month before you start stays empty.
Your auditor reads the period, month by month: who approved each agent and model, what went wrong, and when it was fixed and retested.
The bank’s third-party risk team wants to see how your AI behaved before they sign, and they check the record themselves.
The buyer’s risk team asks what your AI did and who approved it. You send them a record they check offline.
Controls
Controls matched to SOC 2 and ISO 27001, checked against your own records. They are re-checked on a schedule, not once a year, so the evidence is current when someone asks for it. How Controls works.
Already running Alloy or Unit21?
Coriqo takes in control events from Alloy and Unit21, so the fraud and KYC checks you already run go on the same record as your AI approvals and fixes.
Turn your customer’s security review into evidence they can check.
If you build an AI or agent platform, every bank and insurer you sell to asks the same questions: what can your agents do, who approved it, and what happens when one oversteps. Coriqo gives you one record that answers them for each customer. Each customer’s reviewer gets their own expiring, read-only access and checks the record offline. Your sales cycle stops waiting on a spreadsheet.
Today the evidence goes out as expiring reviewer links and proof bundles. A trust page your customers open from inside your product is not built yet. If you need it, tell us: it is the next thing we would build for platform vendors.
The 30-day proof sprint.
One production workflow, one evidence gap, success criteria agreed in writing before day one. It ends with a sealed evidence package that the reviewer you choose has checked themselves. A slide deck is not a deliverable.
One agent or model, its owner and its mandate, approved by a named person on your side.
Detection connected and alerts routed to your paging tool, on an impact scale your team sets.
A control failure shown in a representative environment: breach, finding, page, fix, retest, closed.
The sealed package goes to your bank partner, customer or auditor, who verifies it offline.
Fixed fee, credited in full
A fixed fee, agreed before it starts and set by scope. Credited in full against the first year if you go ahead. Read-only access, inside the boundaries you set. After it, Focused assurance is $1,000 a month for one workflow. See pricing.
We’ll tell you if you’re not ready for us yet.
A good fit if all three are true
- You run AI in production that takes consequential action: credit, fraud, payments or customer operations.
- A named person is accountable when it goes wrong.
- Someone outside your company is asking, or about to ask, for evidence: a bank partner, a customer, an auditor or a regulator.
Not yet a fit if
- Your AI is still in experiments with no production traffic.
- You need a policy template rather than evidence.
- You want a tool that decides for you. Coriqo never makes the decision it records.
Book a 20-minute fit check
Bring one AI workflow and the question someone outside your company is asking about it. We will tell you what you could prove today, what is missing, and whether a proof sprint would close the gap. If we’re not the right fit, we’ll say so on the call.