Teaching case
How an AI project passes approval — or does not, and why both are useful
The system works. The approval chain does not accept that as a category: the second line asks for evidence in a form the pilot team never produced. This page walks a worked case to show what that evidence looks like — and what a project founders on when it cannot produce it.
A constructed case, because a procedure that only ever produces approvals has proven nothing
The institution, the people and the figures are invented. Südhafen Direktbank AG does not exist. What is real: the procedure, the 23 controls, the assessment logic and the documentation it produces. This is a teaching case, not a client reference.
Starting point
A branchless retail bank builds an assistant that also answers questions about contracts and transactions. Around 900,000 customers, €1.4m to build, a launch date already communicated. Information security is brought in ten weeks after project start — after the vendor was selected and the contract signed.
Finding
On 17 February a test customer asks about their last direct debit and receives an amount belonging to a different customer. Filtering sits after retrieval: the system retrieves fragments across the whole corpus and then discards the ones that do not belong. Other customers' data leaves the security boundary before any check applies.
Distinction
The first test result was a bug. Bugs get fixed. The second was the architecture, and architectural decisions are not fixed but taken again. That is exactly where "not yet" parts from "not like this".
Decision
4 green, 11 amber, 8 red. Three of the red controls are not a matter of deadlines: authorisation applied after retrieval, customer data at a vendor without EU processing, deletion in the managed index not evidenceable. The board decides against approval. The submission names five conditions for resubmission. Four weeks later the redesign begins.
What decided the case was not the verdict but the form of the verdict
"The system is not secure" is an opinion. "ZUG-01 red, because authorisation applies only after retrieval, evidence: test record of 31 March" is checkable. Anyone who disagrees has to attack the control, not the person. That is the whole difference, and it decides whether a no becomes a decision on the merits or a conflict between functions.
What does the second line examine?
23 controls in six domains, each with a control objective, an audit procedure in audit language, a named evidence artifact and a mapping to DORA, MaRisk and the GDPR.
RAG Approval BlueprintWhat goes to the board?
An eight-part approval file, from the protection requirement through to the board submission with residual risk assigned and any dissenting opinion recorded. Filled in completely for the approved case.
The approved caseWhat applies to agentic systems?
Risk scoring across six dimensions into four control intensities, plus a gate that emits its findings as a machine-readable build artifact with a manifest rather than as a report.
Agentic AI Governance ToolkitWhat is not here, and why
The toolkit's register of regulatory sources is checked against the primary text from the Publications Office, and the build fails as soon as a label drifts from it. What that does not give you: a statement about whether an obligation applies to your system. This material deliberately does not answer that question.
The supervisory depth is German and EU financial law. Outside that area the control mappings are illustrative rather than authoritative.
A toolkit maintained by one person has a narrower scope than a product with a team behind it. That is the other side of a narrow scope: what is in it is maintained.
None of this is legal advice, a certification, or a statement that a given system complies with anything. An institution makes that statement itself, with its legal function.
What you can do with this
The teaching case explains how a decision like this comes about. The instruments you would prepare it with are published alongside.
If you are facing an approval decision and are not sure which evidence your board will accept, that is the right moment for a conversation.
No form. An email is enough.
Send an email