Compliance decisions on every agent action: the deterministic to probabilistic spectrum

Every action an AI agent takes in a regulated organisation raises the same question: is this allowed under our obligations? Answering it on every action means making a compliance decision in milliseconds, consistently, with evidence to show for it. Here we explain how Solcis makes those decisions, and how you choose between the speed of fixed rules and the judgement of a model, control by control.

Why does most compliance enforcement force a speed vs accuracy trade-off?

Most compliance enforcement sits at one end of a spectrum. Put a model in front of every action and each decision depends on its judgement: outcomes vary, every action adds latency, and you pay for inference whether the action needed judgement or not. Rely only on hard-coded rules and you get speed and repeatability, but nothing that can weigh meaning or intent, or handle the unexpected.

Each end is right for some controls and wrong for others.

How do you set deterministic vs model judgement per control?

Solcis runs both, and treats the balance as a choice rather than a fixed architecture. You decide, per control set and per control, how far toward each end a control sits. At one extreme a control runs on deterministic checks alone, with no AI judgement in the path. At the other it leans on model judgement for a call a rule could never make. In the middle, a rule can use a deterministic initial check that routes to model judgement only when it matches. For example: does this agent action send data outside your environment? If so, a model checks whether any of that data is classified confidential.

When should you use deterministic checks vs model judgement?

How you decide is based on the control in question and latency requirements. Most control sets use a mix.

How does Solcis make a compliance decision?

When you adopt a control in Solcis Compliance Studio, it is authored into up to three types of check, each with a different job:

• Deterministic predicate: a fixed condition tested against the action and its context. Is the payment above the approval threshold? Is the destination outside your environment? It runs for every applicable control, so every action gets a fast, repeatable baseline decision.

• Compiled check: logic too detailed for a simple condition, compiled ahead of time so it runs at near-native speed. For example, matching a counterparty against a restricted list or validating the structure of the data being sent. Still deterministic, with no model involved.

• Model judgement: a model reads the content and judges meaning or intent, such as whether a message discloses material non-public information. It is gated: it runs only when the control includes it and a deterministic condition triggers it, so inference is spent only where a rule can't make the call.

Every action is allowed by default. A rule only ever moves it up, to escalate or to deny, and when more than one rule applies the most restrictive stands. Nothing moves it back down, because allow is the default a rule overrides, not an outcome that can override a denial. An action passes only when no rule moved it off allow. Escalate is set per rule, so you choose which actions need a person to sign off.

What happens when Solcis can't make a decision?

Independence is critical. The engine judges an action against the controls you have configured and what it observes of your environment, not against anything the agent asserts about itself. The agent submits the action and it cannot supply or alter the knowledge that action is judged against. So an agent is unable to talk its way past the controls, which are enforced where your agents live, and because Solcis is self-hosted, enforcement and evidence stay in your environment.

Why does Solcis author controls before enforcement?

Solcis is architected so the heavy reasoning happens once, when a control is authored in Solcis Compliance Studio, not on every agent request. Compliance Studio turns a plain-English control into policy rules, spending inference at authoring time so runtime doesn't repeat that cost per action. The result: the same action gets the same decision every time, because deterministic checks are repeatable in a way a model called live on each action is not.