The governance loop applied to every AI call

Four products, twelve providers and a finance-led board that asks every week what the AI did, why, and what it cost. Without one shared loop, each product would answer those questions differently, or not at all. I owned this one directly: it is the piece I wrote by hand and the piece the other deployments plug into.

It had to sit in front of every model call without adding noticeable latency, work identically for a chat reply and a high-risk action, and produce an audit record a non-engineer on the board could read. It also had to survive provider outages without losing the record of what was attempted.

A closed loop: a policy check decides whether the call is allowed and at what risk level; evidence-pack retrieval attaches the context the model is allowed to see; a prompt registry versions every prompt; the model router picks provider and tier; the action runtime executes only whitelisted actions; the audit ledger records inputs, outputs, cost and decision; high-risk cases escalate to human review; and policy feedback updates the rules from what the ledger shows. I built the loop itself; the products that consume it were designed and shipped with AI agents under my review.

• Qorinix model router (12 providers)
• Prompt registry with versioning
• Content-addressed evidence packs
• Audit ledger with per-call cost attribution
• Human-review queue for high-risk actions
• LaSpend, Fixxmi, Qorinix and the trading desk as consumers

Every call is versioned, costed and replayable. Policy changes are reviewed like code and take effect through the registry, not by editing a product. Escalations land in a human-review queue with the full evidence pack attached. Rollback means pinning the previous prompt and policy versions; the ledger shows exactly which calls ran under which version.

Measured by audit completeness (share of AI calls with a full ledger record) and escalation rate (share of calls routed to human review, watched for both under- and over-escalation). The weekly board report is generated from the ledger. Specific rates are shared on a call rather than published.