Governed AI
AI that helps, inside the rules.
ACSE works without AI. When you choose to turn it on, it explains why a finding matters, drafts fixes for findings no rule covers yet and helps map your own frameworks. Every draft goes through exactly the same validation, guardrails and human approval as a rule-based fix.
Faster understanding
Plain-language explanations of each finding for the people who have to decide.
Coverage for the long tail
A drafted fix for findings with no rule yet, held to the same bar as any other fix.
No surprises
Off by default, turned on step by step with a second admin, and every AI step labelled with the model that made it.
What the AI does
Three steps, each switched on separately
Explain
“Why this matters” for a finding, advisory only. It never changes a result.
Draft
A Terraform patch for a finding with no rule, validated, guarded and approved like any other.
Interpret
A first draft mapping your internal standard to ACSE’s checks, reviewed by a person and published by a second.
Where it runs
Your model, your cloud
The model runs in your own cloud account, through your own AI service, behind a private endpoint. Your configuration and evidence do not leave your boundary to reach it.
A probe at the start of each scan checks the model is available. If it is not, ACSE fails closed and carries on with rules alone.
Questions
What people ask us
Is AI required?
No. Detection and the fixes from remediation directives are deterministic and need no model.
Who can turn AI on?
A tenant admin, per step, with a second tenant admin approving. Each step can be turned off again at any time.
Keep reading
Related
Responsible AI
ACSE’s optional AI runs on Amazon Bedrock in your own account, stays off until two admins turn a step on, and never decides. Every AI step names its model.
ReadPlatformFix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadPlatformApprovals and governance
Every ACSE fix needs a person’s approval with step-up MFA, bound to the exact view they saw. Authors don’t approve their own changes, and two people where policy says.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.