A bank-grade AI governance review, survived by six builders

The email arrives a few weeks into a promising enterprise engagement, and it has an attachment. The attachment is a questionnaire, and the questionnaire is long - the customer is one of the world's larger financial-software companies, they operate under real regulatory obligations, and before your product touches their data, their AI-governance process would like to understand you completely. Where do the models run. Where does the data live, and where is it forbidden to go. What's retained, for how long, seen by whom. What can the AI do without a human. Prove it.

For a six-person company, this moment is existential in both directions. Fail it and the deal is gone, politely. But survive it and the questionnaire flips polarity: it becomes a moat. Most companies our size can't answer it. We could, and this post is about why - because the honest answer turned out to be everything this blog has been describing all along.

What they actually ask

Strip the formality and enterprise AI diligence asks five questions:

1. Where does inference happen? Our answer: Claude on Amazon Bedrock, inside our own VPC, in-region. Prompts and data don't leave our AWS environment for a third-party API; there's no consumer-service dependency in the serving path. US data residency isn't a policy promise, it's an architecture fact.
2. Whose data trains what? Nothing our customers give us trains anyone's models. Bedrock's contractual posture makes this answer clean - one sentence, no asterisks - and it's a large part of why we run inference there despite the trade-offs.
3. Who can see what? Per-organization isolation, flag-gated features, role-gated actions. Every capability in the product - including MCP access - is opt-in per org, and an org admin holds the switch, not us.
4. What can the AI do without a human? Here we just handed them this blog's table of contents. Agents propose; humans approve - merges, specs, releases, submissions. Every autonomous lane has a budget, a scope, and a kill switch. We didn't build any of that for the questionnaire, which is precisely why it held up under one.
5. Show us. The pleasant surprise: because agents do our work through issues, PRs, and recorded verdicts, the audit trail isn't a document we assembled for diligence - it's the system's exhaust. Every AI-authored change in our history has a reviewable record of what, why, and who approved it.

The engagement ran a 24-week proof of concept and moved into the customer's formal AI-governance vendor approval - the long way, the real way. Alongside it, the standards work (ISO 42001, SOC 2) turns the same answers into certificates.

The reframe that made it survivable

The mistake we almost made was treating governance as paperwork to generate - a documents-about-the-system project. The reframe that saved us: governance is a product surface. Every gate, budget, audit trail, and kill switch in our stack is simultaneously an engineering control and a diligence answer. Build the controls for real and the paperwork describes them; build the paperwork first and diligence will eventually ask to see the controls. One of these orders survives follow-up questions.

Real numbers

1. A 24-week enterprise POC progressing into formal AI-governance vendor approval - as a six-person company.
2. Five questions that every serious review reduces to; zero answered with a policy document alone.
3. 100% of AI-authored changes carrying a human-approval record, because that's how the system works, not how it's documented.
4. Two standards workstreams (ISO 42001, SOC 2) converting the same architecture into certificates.

Where the humans sit

Governance is the one place where "where the humans sit" is the deliverable. The review didn't ask whether our AI is impressive; it asked where people hold authority over it. Our answers were credible because they were load-bearing - the same gates that pass a bank's diligence are the ones that let six builders sleep while agents run.

Steal this

Write your AI-governance answers document before any customer asks - the five questions above are the outline, and a draft costs a day. Where an answer embarrasses you, you've found real engineering work, cheaper to do now than mid-deal with a deadline. And if you're small: stop dreading the questionnaire. It's the rare game where being six builders with real gates beats being six hundred with a policy binder - diligence checks substance, and substance is size-independent.

Next week: the year in our own numbers - what our GitHub stats actually show about the AI transition, and what the flattering headline figures hide.

---

This post is part of the product track of How a Tiny Team Ships Like a Big One, a series on how six builders run a production AI company. Building at Aithon - if this is how you want to work, talk to us.