ACSETalk to us
  1. Home
  2. Trust
  3. Responsible AI

Responsible AI

AI that drafts, and people who decide.

ACSE works without AI. Detection, fixes from remediation directives, validation and guardrails are deterministic. If you choose, a model can explain findings, draft a patch where no directive exists, or draft a framework mapping. Every draft goes through the same checks, and a person decides.

Talk to usSee how it works
AI that drafts, people who decideA model sits inside guardrails that apply the same checks as a rule-based fix. Its draft passes to a person, who decides. The AI is off until a customer turns it on.MODELGUARDRAILS · SAME CHECKS AS ANY FIXA PERSON DECIDESdrafts and explains · off until you turn it on
01

Your boundary, your model

The model runs on Amazon Bedrock in your own account. Inference never leaves your cloud.

02

Nothing on by surprise

Every AI step is off by default. Turning one on takes two Tenant Admins.

03

Always labeled

Every step on a case is tagged Rule, Person or AI-assisted, with the model id.

Where the model runs

Inference stays in your account

ACSE uses Claude on Amazon Bedrock in your own AWS account, called by your ACSE runtime through a private endpoint. Its permission is scoped to the one model you choose.

The model receives a sanitized context: resource types, settings and policy names. It never receives secrets or raw cloud responses.

  • Your Bedrock agreement, your account, your region
  • The model id is configuration, recorded in an inventory
  • Turn a step off and the deterministic path returns
Your data stays yoursA wall separates the customer’s cloud, holding resource names, ids, configuration and credentials, from what ACSE’s control plane receives: shapes and counts, such as seven buckets of which two are public.7 buckets · 2 publicno names, no idsYOUR CLOUDnames · ids · configcredentials · raw evidenceWHAT ACSE SEES · SHAPES AND COUNTS

What it may do

Three steps, each off by default

01

Why this matters

A plain explanation of a finding, shown on the finding. Advisory only: it never changes a severity, a decision or a proposal.

02

Drafted patches

For a finding with no remediation directive, a drafted Terraform patch. It passes the same plan, policy re-check, guardrails and human approval as any other fix.

03

Framework interpreter

Drafts a mapping from a framework’s controls to existing checks, with a reason for each. A person edits it, and a second person publishes it.

What it may never do

Lines the model can’t cross

01

Approve

A machine can never hold the approver duty. The system refuses it.

02

Write to your cloud

Drafts become pull requests or reviewable mappings. Nothing is applied by a model.

03

Merge

No fix is merged by ACSE, whoever drafted it.

04

Invent checks

The interpreter maps only to checks that exist. It never writes checks or policy code.

Turning a step on

Two people, one switch at a time

  1. Enable the model in your accountYour team grants Bedrock access to the chosen Claude model in your own AWS account.
  2. Request a stepA Tenant Admin turns on one step in Governance, AI use. Each step is separate.
  3. A second admin approvesAnother Tenant Admin confirms. The change is recorded with who and when.
  4. Fail closed if the model is missingEach scan checks the model first. If it is unavailable, AI steps are skipped and the deterministic path runs.
Nobody approves their own changeTwo people, a risk owner and a security approver, each confirm one change with step-up MFA. Neither of them wrote it.RISK OWNERSECURITY APPROVER✓ step-up mfa✓ step-up mfaONE CHANGEtwo people · neither of them the author

Our rule

Turn every AI step off and ACSE still detects, fixes and proves. The chain never depends on a model.

AI drafts and explains. Rules, tests and people decide.

Questions

What people ask us

Is ACSE’s detection done by AI?

No. Checks are deterministic policy evaluated in your runtime. AI is never used to decide whether a resource passes or fails.

How do I know which steps used AI?

Each step on a case is tagged Rule, Person or AI-assisted, with the model id. A drafted patch is marked as AI-authored in the approval view, which names the model.

Does InitValue see what the model sees?

No. The call goes from your runtime to Bedrock in your account. ACSE’s control plane receives only the result records it already handles, such as a draft or an explanation tied to a case.

Can we use AI for explanations only?

Yes. Each step is switched on separately, so you can turn on explanations and leave drafted patches and the framework interpreter off.

Keep reading

Related

Platform

Governed AI

ACSE’s optional AI explains findings and drafts fixes inside your own cloud. Every draft goes through the same checks and a person. Off until you turn it on.

ReadTrust

Data boundary

ACSE runs in your account and sends only shapes and counts. Names, ids and credentials stay with you, and a deny-by-default registry governs what leaves.

ReadPlatform

Fix

ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform