What RIA Teams Can Assess in AI Compliance Controls
When operations and compliance teams review AI workflows, the useful questions are practical: who can see what, what reaches a model, what is recorded, and where the work runs. This page maps the controls Ariath documents on its product page to the questions a review can ask.
Controls and the questions to bring to your review
Use the right column as a starting list for your own vendor review. The middle column restates what Ariath describes for each control, and nothing more.
| Control | What Ariath documents | Question to ask |
|---|---|---|
| Access before model use | Role-based access is checked for the specific user before connected data reaches a model, scoped to the user and workflow. | Which roles can see which client data in each AI workflow, and who maintains those permissions? |
| Redaction | Redaction and data-handling controls are configurable per workflow, based on the workflow and the sensitivity of the data. | Which fields does your firm want masked in each workflow, and who signs off on that configuration? |
| Audit logging and retention | Structured, queryable records of requests, with audit and retention settings configured around each workflow. | What does your firm need to be able to reconstruct about an AI-assisted task, and how long should that record be kept? |
| Approved models | Requests route to models your firm has approved, and a governance console sets which models each user can access. | Which models has your firm approved, for which users, and who decides when defaults change? |
| Workflow-scoped governance | Governance settings are set per workflow, so different workflows such as onboarding and proposals can run under different controls. | Which of your workflows carry different risk, and should each have its own settings? |
| Tenant-specific deployment | Workflows, prompts, and tuning stay in your firm's own private environment. | Where do your firm's prompts and configurations live, and who else can reach them? |
Each control is configured around your firm's workflows and policies. See the full feature descriptions on the product page.
What these controls do not do
Operational controls support a review. They do not settle it.
Controls are not legal compliance
Ariath's controls are operational. They do not certify that a firm, a workflow, or an output satisfies any particular regulation, and they do not replace your firm's own policies, supervision, or legal counsel.
Settings reflect your firm's choices
Access, redaction, audit, and retention are configured for each workflow. What they capture, mask, or keep depends on how your firm sets them up and on the policies behind them.
Review of AI output stays with your firm
Controls govern how data and requests are handled. Your firm remains responsible for reviewing AI-assisted work and for deciding which workflows are suitable for AI at all.
Requirements differ by firm
Regulatory and contractual obligations vary by firm and change over time. Confirm the specifics that apply to you with your compliance lead or counsel.
Map these questions to your own workflows
Book a working conversation with the Ariath team to walk through the workflows your firm is considering and the controls each would need.