Trust
Trust and control – even when the agent does the work.
Automation should be understandable, scoped and possible to stop. These are the controls we can implement and contract – and what we do not claim before evidence exists.
Controls we can contract
The exact scope depends on the solution, systems and customer requirements. Nothing below is a certification; it is a control to be specified, implemented and verified.
Data and ownership
The customer owns its data. SIAX processes it under the agreement, documents subprocessors and does not use customer data to train models. Storage and any external model traffic are described per solution.
Least privilege
Separate read and write access, scoped service identities and revocable permissions. An agent must not have broader access than the process it performs.
Human control
Actions that affect customers, agreements or finances require approval. Exceptions go to an owned review queue with the original material and a clear next action.
Traceability
Every run, tool call, exception and decision should be followable. Versions of the process, price, rule and document are frozen so an approval refers to what the customer actually saw.
Automation with boundaries
Deterministic rules and integrations are used where they suffice. AI is used where variation and judgement require it – with small, schema-bound tools and no free SQL, shell or production keys.
Incident and rollback
A named incident path, a manual fallback, pause and reconciliation of unknown external outcomes. A restored environment must not reactivate revoked access or send the same action again.
What the customer retains
The customer retains responsibility for business rules, data and decisions that require a mandate. SIAX is responsible for the agreed technical solution and for describing boundaries, dependencies and residual risk.
An approval in the portal must refer to a specific version of the material. Changed scope, price or data access requires a new decision – not a silent adjustment.
- The customer appoints the process owner and approvers.
- The customer decides on data access and mandates.
- The customer owns acceptance and production activation.
- The customer can revoke access and request an export.
- The customer receives documentation to take over.
Questions to ask before buying
Which systems and data may the automation read and write?
Which actions require human approval?
How is a run stopped, and what happens to in-flight calls?
How is an unknown external outcome detected and reconciled?
Which traces are stored, for how long and who can read them?
What happens at exit – export, revoked access and retention?
What we do not claim
We do not claim the solution is ISO- or SOC-certified unless such certification exists for the specific service. We do not claim AI removes the need for human control. We do not promise a saving before the baseline, volume and system conditions are verified.
Where a control requires a specific edition, agreement or external audit, we report it as a requirement – not as a fulfilled property.
Want to test the requirements against your process?
Describe the process and which data is sensitive. We will come back with a proposal for scope, controls and the next step.
Describe your process